Built for schools, with data protection in mind.
The school is the data controller; Coding Pathway is the data processor, acting on the school's instructions. We process data only to run the service — never for advertising or unrelated profiling. Here's where data lives, how it's secured, and the documents your DPO will want.
Hosted in the EEA
All data — accounts, learning records, student work, email — is hosted in AWS eu-north-1 (Stockholm, EEA). UK-to-EEA transfers rely on the UK's adequacy regulations.
Encrypted in transit and at rest
TLS (HTTPS) is enforced for every connection; the database is encrypted at rest (AES-256).
Sign in with school accounts
Authentication is via Google or Microsoft single sign-on. We don't store passwords for SSO users. Access is role-based, and admin actions are logged.
Student code runs in the browser
Pupils' Python runs sandboxed in the browser, not on our servers, with imports restricted — student programs can't reach our infrastructure.
No student-facing AI, anywhere
Pupils never interact with AI. AI is a staff-facing authoring aid only, and a teacher reviews every output before any student sees it.
Breach commitment
We notify a school of any breach affecting their data without undue delay (within 24–48 hours), with the detail they need to meet their own 72-hour ICO obligation.
AI helps teachers, never pupils.
AI features are staff-facing authoring aids — drafting content, tidying instructions, drafting feedback. Pupils never interact with AI, and a teacher reviews every output before use. A school can switch AI off for its organisation entirely.
When AI is used, what's sent to the provider (OpenAI) is task content and the student's own work (code/text) — never names, emails, or account identifiers. OpenAI is engaged under a signed Data Processing Agreement that applies the UK Addendum to the EU Standard Contractual Clauses, and OpenAI does not use the data to train its models. This approach is mapped against the DfE's “Generative AI: product safety expectations.”
Documents available to schools.
Data Processing Agreement
An Article 28 DPA covering roles, security, sub-processors, breach notification, data rights and deletion — available for your review and signature.
Sub-processor register
A current, named list of the third parties we use, with their role, location and transfer mechanism. View the list →
DPIA & data protection
A completed Data Protection Impact Assessment (summary available on request) and our privacy notice. Read the privacy notice →
To request the DPA, the DPIA summary, or our ICO registration and security details, email schools@codingpathway.co.uk. We're a UK provider built by a serving Head of Computer Science.
Last reviewed 5 July 2026. Coding Pathway is operated by Coding Pathway Ltd (registered in England and Wales, company number 17313032).