Security built into every layer.
Our approach to security is comprehensive, proactive and aligned with globally recognised standards. We are proud to be ISO 27001:2022 compliant, showcasing our commitment to maintaining a robust Information Security Management System (ISMS).
This page outlines the key measures we take to ensure the confidentiality, integrity and availability of data across our platform. From rigorous data protection policies and secure hosting infrastructure to stringent access controls, encryption practices and incident response planning - security is built into every layer of our operations.
Whether you’re a customer, partner, or stakeholder, our Trust Centre provides transparency into how we protect your information, comply with GDPR, and continuously evolve our security practices to meet the highest standards.
1. ISO 27001:2022 Compliance & Trust Center
Certification
We are ISO 27001:2022 compliant, demonstrating we have an established Information Security Management System (ISMS) that follows globally recognised standards.
This certification ensures systematic risk management, continuous security improvement, and adherence to robust policies that protect the confidentiality, integrity, and availability of information.
We have a defined process for responding to data incidents, supported by a documented incident response plan reviewed regularly as part of our ISO compliance. The process includes internal reporting, escalation to our DPO and product leaders, immediate investigation, logging, analysis, remediation, and reporting to the ICO if necessary. Our current incident history is published in the Applicaa Trust Centre, so it is always up to date rather than a snapshot.
We have published our ISMS security policy, procedures, and controls in our Applicaa Trust Centre for easy access, providing a more detailed view of our security practices.
2. Data Protection & GDPR Compliance
Policies & Procedures
We have a comprehensive Data Protection and GDPR Policy in place. These policies are readily available on our website and upon request to assist with any DPIA (Data Protection Impact Assessment) processes.
The privacy policy includes details on the specific information shared with subprocessors and the purpose of that sharing.
They are based on best-practice templates and align with regulatory guidelines (e.g., ICO Guidance).
3. Hosting & Physical Security
AWS Infrastructure
Our services are hosted on Amazon Web Services (AWS) in London.
AWS provides best-in-class cloud and physical security controls such as restricted physical access, video surveillance, and multi-factor authentication for data center personnel.
This robust infrastructure addresses the critical physical security concerns around server hardware and facilities and service reliability.
4. Network & Application Security
Penetration Testing
We conduct annual penetration tests on our application and infrastructure.
Our penetration testing partner - Astra Security is CREST Approved, confirming the testing meets recognised industry standards and covers critical vulnerabilities (including the OWASP Top 10).
Secure Development Lifecycle
We adhere to secure coding practices and perform code reviews to mitigate common vulnerabilities. This includes scanning code changes for security vulnerabilities before deployments.
Regular security assessments ensure ongoing alignment with best practices.
5. Authentication & Access Controls
2FA (Two-Factor Authentication)
We offer 2FA that schools can activate for staff and applicants.
This extra layer of security helps ensure only authorised individuals can access the system.
We also offer Single Sign-On (SSO) that schools can activate for staff accounts. When SSO is enabled, 2FA is automatically disabled for staff accounts.
Brute Force Protection
We implement throttling for repeated failed login attempts. This prevents large-scale brute force attacks while avoiding unnecessary lockouts for legitimate users.
Admin Access
Administrative privileges are restricted to authorised Applicaa staff personnel. Access to customer platforms is via company SSO.
Support staff have limited privileges for editing and exporting data.
Access to AWS Database is managed via VPN and MFA. Access is limited to specific engineers and logging is in place.
Access to critical systems including AWS is reviewed regularly as part of ISO Compliance.
All employees must complete regular security and GDPR training to stay informed on best practices for protecting personal and confidential data.
6. Data Security & Encryption
Encryption in Transit
All data transmitted between the platform and users is secured with HTTPS/TLS, protecting it from interception or tampering.
Encryption at Rest
Our databases and backups are encrypted using keys managed through AWS KMS.
Sensitive data (e.g., passwords) is stored using secure hashing and salting methods.
Multi-Tenant Architecture
Customer data resides in a shared database environment with separate schemas, ensuring logical segregation.
This structure simplifies backups, restores, and data exports while maintaining strict access control.
7. Backup, Disaster Recovery & Data Retention
Backup Frequency & Retention
We maintain point-in-time backups for the last 35 days to enable quick restoration if needed.
Beyond 35 days, periodic backups are retained for up to 2 years, allowing extended recovery options.
Storage Location & Encryption
Backups are stored securely in AWS.
All backup data is encrypted at rest using the same key management system as our production database.
Restoration & Testing
We regularly test our restore procedures to ensure minimal downtime in case of incidents.
Access to backups is limited to authorized personnel with strict controls in place.
8. API Security
Secure Connection
Our MIS Integrations communicate with the MIS over HTTPS/TLS, providing end-to-end encryption.
API credentials are encrypted.
Data Handling
The integrations securely transmit data to the web API. There is no local storage of data beyond what is necessary for authenticated sessions.
All data transfer is protected in transit, ensuring confidentiality and integrity.
Questions your DPO wants answered?
Send them over. We would rather answer them properly now than have you find out later.