Security Statement & Sub-processor List

Part 1 — Security Statement

1. Our approach

Effective Clerking holds governance records for schools and trusts. Those records can contain confidential staff matters, safeguarding references and other sensitive material. We treat security as a condition of being in this market, not a feature.

We are a small organisation, and we say so plainly rather than implying a security team we do not have. What we do have is a small, modern, well-understood stack, strong isolation between customers, and a limited number of people with access.

2. Where your data lives

We do not claim that all your data stays in the UK, because it does not. Every transfer outside the UK is covered by a safeguard under Chapter V of the UK GDPR — see Part 2 and section 5 of our Privacy Policy.

3. Access control

Individual named accounts; no shared logins.

Multi-factor authentication available to all users, and enforced on every administrative and production account, including our own accounts with each infrastructure provider.

Role-based access within each customer’s area.

Least-privilege access to production, granted to named individuals and reviewed every 6 months.

Immediate revocation on role change or departure.

Passwords stored only as salted hashes. No plaintext credentials anywhere.

4. Isolation between customers

Every record carries an organisation identifier, and isolation is enforced at the database layer by row-level security policies rather than only in application code. There is no cross-tenant sharing, no cross-tenant search, and no public sharing links.

5. Encryption

TLS 1.2 or higher for all data in transit.

Encryption at rest for the database, file storage and backups.

Secrets and API keys held in the hosting provider’s environment store, never in source control. Pre-commit secret scanning on the code repository.

Our AI provider’s API key is server-side only and is never exposed to a browser.

6. Audit logging

Every document and every tracked action carries a permanent, human-readable reference number, and every state change is recorded: creation, editing, AI reformatting, flag dismissal, approval, sending, status change and voiding — with the actor and timestamp.

Once a document is sent, its content is locked. A correction produces a new version under the same reference number rather than overwriting the original, mirroring how minute amendments work in practice.

Access by our own personnel to customer content is logged and attributed, and available to the customer on request.

7. Software security

Dependencies kept current; high and critical vulnerability patches applied within 14 days of availability.

Lint, type-check and build checks on every change before merge.

Automated dependency vulnerability scanning via GitHub Dependabot, enabled on the code repository.

A white-box security assessment (code and infrastructure configuration review) was completed on 2 September 2026. All findings were remediated the same day, except one Supabase dashboard setting that remains an open action for us. We plan to repeat an assessment of this kind at least annually, and after any significant architecture change.

8. Backup and recovery

Automated daily database backups, retained for 7 days. Point-in-time recovery is not currently enabled.

Target recovery point objective 24 hours; target recovery time objective 24 hours

Recovery tested at least annually.

Customer-initiated export available at any time.

9. People

Binding confidentiality obligations on everyone with access, surviving the end of engagement.

Data protection and security awareness training on engagement and at least annually.

DBS position: as a remote software supplier we do not engage in regulated activity and are not required to hold DBS clearance.

10. Incident response

We maintain a documented incident response plan with defined roles and timescales. Where a personal data breach affects customer content, we notify the affected customer without undue delay and in any event within 24 hours of becoming aware, with enough information for them to meet their own 72-hour obligation to the Information Commissioner’s Office.

We keep an internal record of every personal data breach, whether or not it is reportable.

11. Certifications and assurance

We would rather state this honestly than imply certifications we do not have. Our infrastructure providers hold SOC 2 Type II and, in most cases, ISO 27001; details are in Part 2.

12. Reporting a vulnerability

If you believe you have found a security issue, please tell us privately at support@effectiveclerking.co.uk rather than disclosing it publicly. We will acknowledge within 5 working days, keep you updated, and will not pursue action against anyone who reports in good faith, does not access or alter other customers’ data, and gives us reasonable time to fix it.

Part 2 — Sub-processor List

Current as at 07/09/2026. We give at least 30 days’ notice before adding or replacing a sub-processor that processes customer content. To be notified of changes, email support@effectiveclerking.co.uk.

2.1 Sub-processors that process Customer Content

Supabase

Vercel

Anthropic — our current AI provider

Stripe

Resend

Additional or contingency AI providers

None currently engaged. Anthropic is our only AI provider today. We may engage an additional or alternative one — for continuity if our primary provider is unavailable, for a particular feature, or because a better option becomes available.

Any AI provider must meet all six of these before it processes any customer content, and we will not use one that does not:

A data processing agreement containing the terms required by Article 28(3) of the UK GDPR.

A contractual prohibition on training models on customer content.

A published retention position, at the shortest retention the provider offers.

A lawful transfer mechanism under Chapter V of the UK GDPR where processing is outside the UK.

Current, published independent security certification.

A published sub-processor list.

Before any such provider begins processing, we add it to this list, give customers at least 30 days’ notice under clause 5.3 of our Data Processing Agreement, honour the right to object in clause 5.4, and complete a transfer risk assessment.

2.2 Things worth telling you plainly

Our sub-processors have their own sub-processors, including AI providers we did not choose. Supabase lists OpenAI, LLC among its sub-processors. Resend lists Anthropic PBC and RunPod. We monitor these lists and will notify you of changes that materially affect customer content.

Some transfers rely on the EU-US Data Privacy Framework. The Framework’s validity is currently subject to an appeal before the Court of Justice of the European Union (Case C-703/25 P, Latombe). For that reason, every arrangement above also has a Standard Contractual Clauses or International Data Transfer Agreement fallback, so that a change in the Framework’s status would not leave a transfer unlawful.

We maintain a transfer risk assessment for each of these recipients, reviewed at least annually. A summary is available to customers on request.