Insight (Insight Tracking)

Provider statement: schools use Insight to record and analyse pupil assessment, attendance and characteristics data and to produce reports for staff, governors, parents and trusts. Data enters through a nightly MIS sync via Wonde (a named subprocessor), CTF or Excel uploads, CSV imports, manual entry, and an onboarding import in which the provider's content team loads the school's historical summative assessment data. This onboarding import means the school sends pupil data files to the provider; the terms of service require these to be sent securely following the provider's instructions. Data is seen by school users according to their role, by Equin as processor and by the subprocessors listed in the data processing agreement. Parents receive reports the school produces. The provider's MAT reporting page states that early national indicators are calculated from data entered by Insight schools, so each school's assessment data contributes to figures shown to other customers. The terms of service allow the provider to use anonymised and aggregated statistics for analytics, benchmarking, research and product development, and the privacy notice states anonymised or aggregated data may be shared with partners for marketing and strategic development. Ask the provider: How is school data anonymised before it is used for national indicators or benchmarking, and can a school opt out? Not independently verified.

Provider statement (data processing agreement Annex A and security page): pupils, school staff and other authorised users, plus parent or guardian contact details where imported. Required pupil data: UPN, legal and preferred names, date of birth, gender and enrolment dates. Optional pupil data: address, ethnicity, EAL status, FSM history, SEN history, service child status, in-care status, attendance summaries, custom groups, free-text notes, photographs and contacts. Assessment data includes statutory results, test scores, teacher judgements and supporting evidence such as images, comments and attachments. Staff user data: names, email addresses, roles, access levels and hashed passwords. Ethnicity is special category data; SEN history may reveal health information; in-care and FSM status are sensitive. Insight has no safeguarding module, but free-text notes and attachments could be used to record safeguarding or health details. The provider acknowledges its services may involve special category data. Not independently verified.

Provider statement: identifiable pupil data is needed for the core purpose (UPN, names, date of birth, gender, enrolment dates), so anonymised use is not possible for pupil-level tracking. Many attributes are described as optional, and the provider states a governor role can be configured without access to personally identifiable information. The sources do not say whether a school can choose which optional fields are imported through the Wonde MIS sync. Ask the provider: Can we stop the MIS sync importing fields we do not need for tracking, such as address, contacts, photographs, ethnicity or in-care status? Can unused optional fields be removed from existing records? Not independently verified.

Provider statement: the data processing agreement (accepted electronically when a trial or subscription starts) states that the customer is controller and Equin Limited is processor, and says it contains the Article 28(3) UK GDPR clauses. Annex A lists subprocessors: Amazon Web Services, Inc. (hosting, UK), RavenDB Ltd. (database hosting, UK), Wonde Limited (MIS import, UK), Aircall SAS (telephony for support, Germany), FrontApp, Inc. (support email, Ireland), Microsoft Limited (support tools, UK) and Slack Technologies Limited (internal communication, UK). Schools get 30 working days to object to a new subprocessor. The security page names Hibernating Rhinos, not RavenDB Ltd., for database hosting; confirm which entity is contracted. The privacy notice states Equin is controller for its websites, marketing, events and recruitment, and controller or processor for support communications. ICO registration reference Z1904040 and a named DPO are stated by the provider; the ICO register was not checked. The terms of service rank the data processing agreement below the main terms and schedules, while the data processing agreement says it prevails over the main terms. Schools should confirm which document governs data protection obligations and that Annex A is current. For academies, the terms state the academy trust is the contracting entity. Not independently verified.

Provider statement: the security page (checked 24 October 2026) states all Insight application and customer data is hosted in the United Kingdom on AWS, with database hosting in the UK, and backups stored in the UK across at least three AWS availability zones. Support subprocessors Aircall (Germany) and FrontApp (Ireland) handle support calls and emails, which may contain pupil or staff data. The data processing agreement states that neither Equin nor any subprocessor will transfer personal data outside the UK and EEA without a UK GDPR safeguard or the school's prior written consent. The privacy notice says appropriate safeguards are used for transfers outside the UK or EEA but does not name the mechanism. The contracting entities named for hosting and support email are Amazon Web Services, Inc. and FrontApp, Inc.; the sources do not say whether data can be accessed from outside the UK and EEA. Ask the provider: Is any customer or support data accessed from outside the UK or EEA, including for remote support by subprocessors, and if so which safeguard (for example the UK International Data Transfer Agreement or Addendum) applies? Schools outside the UK should note that the data processing agreement is written for UK GDPR only. Not independently verified.

Provider statement: the security page says personal data is kept only while a subscription is active, remains available for export for 30 days after it ends and is then deleted automatically. Nightly backups are kept for 14 days; the page also mentions weekly logical backups without a separate retention period. System logs (which may contain UPNs, assessments and user emails) are kept for 45 days, support emails up to 36 months and call recordings up to 12 months, with deletion of the last two on request. The terms of service (clause 14.3.4) state customer data will be destroyed 30 days after termination unless a written request for the most recent backup is received at least ten days before termination, that the school must pay reasonable expenses for return or disposal, and that the provider will confirm destruction in writing. The sources do not state how long records of pupils who leave the school are kept during the contract. Ask the provider: Are leavers' records deleted automatically or kept until the school deletes them? How long are weekly backups kept? What charges apply to returning or disposing of data at contract end? Not independently verified.

Provider statement (security page, checked 24 October 2026): TLS 1.2 or higher in transit and AES-256 at rest; role-based access; multi-factor authentication available; Microsoft single sign-on, which admins can require at school or trust level (the help guide says it is enabled by default but also that it is behind a feature flag and must be requested); minimum 10-character passwords, BCrypt hashing, breached-password checks and login throttling; logging of security events and access to personal data; changes to data logged with user and timestamp; annual penetration testing by CREST-accredited providers; logical separation between schools; staff vetting and annual training; documented incident response plan. The data processing agreement requires breach notification without undue delay but gives no fixed number of hours. The provider states it holds Cyber Essentials (not checked on the IASME register) and is working towards ISO 27001, so it is not ISO 27001 certified. The security page gives two different restore testing frequencies (twice a year and at least annually). Ask the provider: Can admins make MFA mandatory? Can the school view audit logs of who accessed pupil records? How many hours after discovering a breach will the school be told? Can you supply the current Cyber Essentials certificate? Not independently verified.

Provider statement: no AI features were found in the Insight product on the website, pricing page or help guides reviewed (checked 24 October 2026). The privacy notice states Equin uses AI tools to summarise customer support requests, that these tools are hosted within its cloud environment, are used for support and service improvement, do not make decisions about individuals, do not use customer data to train AI models and do not share data with third parties. The AI service or model is not named, no AI provider appears in the data processing agreement subprocessor list, and the data processing agreement does not mention AI. Support requests may contain pupil or staff data. Ask the provider: Which AI service summarises support requests and where is it processed? How long are summaries kept? Is this processing covered by the data processing agreement? Can the school opt out? Not independently verified.

Provider statement: Insight analyses attainment, progress and attendance for individual pupils and groups, including by characteristics such as SEN, EAL, FSM and service child status, and calculates percentiles from standardised scores. The sources describe reporting to support staff judgement, not automated decisions about pupils; decisions about interventions and provision remain with school staff. The security page states the provider appointed a DPO because its business involves regular and systematic monitoring of individuals on a large scale, including special category data. No automated decision-making with legal or similarly significant effects was found in the sources. Schools should ensure staff understand that group comparisons by characteristic are a prompt for professional review, not a judgement about an individual pupil. Not independently verified.

Provider statement: the privacy notice explains Equin's role and says parents wishing to exercise rights over pupil information should contact the school or trust first. The security page states schools can export pupil data from Insight to answer subject access requests and can correct, delete or restrict data directly in Insight. The data processing agreement commits Equin to assist with data subject requests at no additional cost and to notify the school within 7 days if it receives a request directly. Schools should name Insight and Equin as a processor in their own pupil and staff privacy notices. Not independently verified.

Risks specific to school use, based on the sources above: (1) Concentration of sensitive data: one system can hold whole-school pupil records with ethnicity, SEN, in-care, FSM and service child status, notes and photographs, so a breach or account compromise would have high impact. Safeguard: sync only the fields needed, review role permissions termly, require SSO or MFA, and remove leavers' staff accounts promptly. (2) Free-text notes and attachments may collect safeguarding or health details outside the school's safeguarding system. Safeguard: issue staff guidance on what must not be recorded in Insight. (3) Contract end: data is destroyed 30 days after termination, a backup must be requested at least ten days before termination, and charges may apply. Safeguard: diarise a full export before giving notice. (4) Conflicting precedence clauses between the terms of service and the data processing agreement. Safeguard: ask the provider to confirm in writing that the data processing agreement prevails on data protection matters. (5) Support channel: emailed pupil data is held for up to 36 months by a support email service in Ireland and may be summarised by an unnamed AI tool. Safeguard: avoid sending identifiable pupil data by email and request deletion afterwards. (6) Onboarding imports involve sending historical pupil data files to the provider. Safeguard: agree a secure transfer method in advance. (7) Reuse of anonymised or aggregated data for benchmarking, product development and sharing with partners. Safeguard: ask how anonymisation is done and whether schools can opt out. (8) The terms exclude supplier liability for loss or corruption of data. Safeguard: consider this in the school's risk assessment and keep periodic exports.

For the school's data protection lead: the intended use involves systematic processing of children's personal data, including optional special category data, so it is likely to need a full DPIA under the school's own assessment. Questions to resolve with the provider before use: (1) Which document prevails on data protection: the terms of service or the data processing agreement? (2) Is the contracted database host RavenDB Ltd. or Hibernating Rhinos, and is Annex A current? (3) Is any data accessed from outside the UK or EEA, and under which transfer safeguard? (4) Which optional fields can be excluded from the MIS sync? (5) How long are leavers' records and weekly backups kept, and what does data return or disposal at contract end cost? (6) Which AI service summarises support requests, where, for how long, and can the school opt out? (7) Can MFA be enforced, and can the school view access audit logs? (8) What is the breach notification timeframe in hours? (9) Can you provide the current Cyber Essentials certificate and penetration test summary? (10) How is anonymised or aggregated data produced, and can the school opt out of its reuse?