How FirstDay protects
your school's data.

01Each school's data is its own

Every record in FirstDay belongs to one school. Before anything is read or written, the request is checked against that school and against the person's role in it, whether it comes from a member of staff, the mobile app, the API or an AI assistant.

• API keys belong to one school and only ever act within it.
• In a group of schools, each person is given access school by school: none, member or admin.

02Who can see what

Access inside a school follows roles. Your owners and admins decide what each role can do, and can create custom roles for the jobs your school actually has.

Some permissions are left out of the default staff role on purpose, so someone has to decide to give them:

• Sensitive personal data. National ID and passport numbers, home addresses, medical conditions, allergies, medication and SEN diagnoses. Without it, these fields are masked.
• AI assistant access. Connecting Claude to the school's data through the MCP server.
• Exports of family details. Downloads such as the clubs sign-up list with every parent's email address, or a transport route with riders' contact details.
• Emails to a whole year group. Sending one message to every family in a year group at once.
• The family map. The map of where your families live.

Your school's owners and admins hold every permission, so keep those roles to the people who need them.

03Medical and safeguarding information

A teacher without “Sensitive personal data” still sees what they need to keep a child safe: what to do in an emergency, where the medication is kept, who to ring and which consents the family has given. They are not shown the name of the condition, the allergen, the medication or the SEN diagnosis.

Each wellbeing note is written for one of three audiences: all staff, the pupil's tutors and senior leaders, or senior leaders only. Safeguarding concerns can be kept to senior leaders.

04How data is stored and sent

• Traffic to FirstDay is served over HTTPS.
• Uploaded documents are kept in private storage and open only through signed links that expire within five minutes.
• Logins your school saves for outside services, such as Polish Compliance provider accounts, are encrypted with AES-256-GCM and bound to your school, so they cannot be opened from another school's account.
• API keys and AI assistant keys are stored only as a hash. Nobody, including us, can read one back.
• On public forms, IP addresses are kept only as a salted hash, used to limit repeated submissions and deleted once they expire.
• Webhooks carry an HMAC-SHA256 signature with a timestamp, so your systems can check that a message came from FirstDay and is recent.
• Encryption at rest: encryption at rest to be confirmed.
• Backups and recovery: backup and recovery arrangements to be confirmed.

05A record of every change

Every change made in FirstDay is written to your school's audit log: what changed, who changed it and when. Signed webhooks can also tell your own systems when leads, pupils or resignations change.

06Forms on your website

Enquiry, booking and visitor forms embedded on your website are protected by bot detection and rate limits, so they cannot be flooded with automated or repeated submissions.

07Kept only as long as you decide

• Set a window, and documents uploaded for an enquiry that was lost or deleted are removed automatically once it passes.
• Set a window, and visitor records are anonymised once it passes, keeping only the counts.
• Both are off until your school sets them, so nothing is deleted without your decision.
• When a school's agreement ends: data return and deletion on exit to be confirmed.

08AI features

• Automatic AI lead scoring is off until your school turns it on.
• Claude can reach your school's data only for people given AI assistant access, and only what that person could see themselves.

09Your school stays in control

In the platform your school is the controller and FirstDay is its processor, acting only on your instructions under a data processing agreement. The formal detail is in our Privacy notice.

10If something goes wrong

If a personal data breach affects your school: breach notification commitment to be confirmed.

To report a security concern or ask a data protection question, write to privacy contact email address to be confirmed.

Data Protection Officer: data protection officer details to be confirmed.

11What we don't offer yet

• Two-factor sign-in is not built into FirstDay yet. Staff who sign in with Google are covered by their Google account's own protection, including any 2-Step Verification your school enforces in Google Workspace.
• Sign-in with Microsoft and SAML single sign-on are not available today.

We would rather tell you now than have you find out in a security questionnaire. Talk to us if either matters for your school.