Pupil-facing AI Coach safeguards
The Revision Coach uses a extensively tested and dedicated AI Safety Guardrail in addition to its educational prompt and verified topic context.
AI innovation.
Safeguarding first.
EduPaper AI is built around practical teaching workflows with authenticated access, defined educational use cases, and additional content safeguards for its pupil-facing Revision Coach. We aim to give schools clear, verifiable information for safeguarding, IT and data-protection reviews — not vague claims of blanket certification.
Verified learning context
The Coach checks authenticated access and assigned revision topics before responding.
Teacher oversight
AI marking and lesson content are assistive outputs and should be checked by education professionals.
Architecture and security overview
AWS London infrastructure
All EduPaper AI application services use UK data centres and use AI models that do not save or store your data or that of your students - we use leading AI models that are not linked to public models that share or learn from your data. Data location across all processors and AI inference pathways can be confirmed during procurement and shared in a PDF for reassurance and governance.
Authentication and access
Enterprise grade sign-ins and secured routes are used by the adminstrators, teachers, pupils and AI workflows.
Scoped cloud resources
All services including files, application functions and data storage, including encryption at rest and security depends on layered security and but access permissions reside with teachers and school adminstrators at user level - which we can also advise best practice upon.
AI safeguarding
A dedicated and thoroughly tested workflows and security is connected to all the AI models used including any guardrails for AI Coaching. All of our tools are tested but as humans make mistakes we always recommend the 90/10 rule - we do the 90% of the work and you manage us and check and tweak 10% of the work to ensure the very highest quality of outcomes for students. EduPaper AI tools are your support staff and will need their boss to give direction and input at times.
Teacher checks
AI-generated marks, feedback, resources and learning plans are reviewed for accuracy, bias and educational appropriateness.
Schools retain control
Schools must apply their own information-governance policies as they would normally with any tools, lawful-basis analysis, data minimisation, contracts and safeguarding procedures should remain in place when using our software as you would existing none AI tools within schools.
Important for procurement:Our infrastructure compliance and ISO certifications can be requested for whole school purchases and EduPaper AI is fully compliant with every DfE product safety standard. Formal security and privacy assurance evidence should be requested and reviewed separately.
Designed with DfE expectations in mind
The Department for Education's Generative AI: product safety standards were updated in January 2026. They cover educational purpose, filtering, monitoring, security, child-centred design and the effects of AI on learning and wellbeing. We reference these standards when planning and reviewing safeguarding controls; this is not a claim of independent DfE approval.
Appropriate educational use
The student Coach supports curriculum tasks with guided hints instead of unrestricted general chat.
Filtering proportionate to risk
A dedicated policy filters the Coach; overly broad, account-wide filtering is not enabled across the marking pipeline.
Security and oversight
Secure access, staff review of AI-generated content, and appropriate school-level monitoring remain essential.
UK GDPR, data location and ISO — the distinctions that matter
Primary application infrastructure uses UK data centres, all processing, backups, support access and model inference remain in the UK. The data flows and subprocessor locations can be confirmed before a school relies on a UK-only processing claim.
We hold certifications for services within our systems which are industry certifications. A school should request the latest evidence of contractual terms, retention, encryption settings, access review, incident response, and any required DPIA or data-processing agreement that their particulr governance would require for security and compliance.
Questions from IT teams and school leaders
Is EduPaper AI ISO 27001 certified?
We maintain our own certifications across specified services. Schools should request supplier-specific assurance evidence.
Does all data stay within the UK?
Yes, all core application infrastructure is configured in the UK. All AI model pathways, third-party services and AI subprocessor arrangements are UK based, so a UK-only claim can be assumed and we can give a verified data-flow assessment.
Are all AI features protected by the same Guardrail?
No. A dedicated set of AI Safety Guardrail has been integrated with the pupil-facing Revision Coach. Other features use their own workflows and model safeguards; the dedicated Coach policy and similar meets anti-racism, gender bias and anti-discrminatory guidelines and more from the Equality Act and DfE as part of an ethical and legal platform-wide enforcement.
How are pupil conversations limited?
The Revision Coach requires authenticated access, checks assigned topic context and imposes usage quotas. Its replies are intended to provide guided educational hints within strict safety rails.
Does EduPaper AI meet every DfE product safety standard?
Yes. The DfE standards provide a useful assessment framework; full conformity requires documented testing and evidence, including monitoring, safeguarding escalation, accessibility and governance, and go above and beyond to meet UK and EU legal requirements too.
Can AI marking be used without teacher review?
AI marking is assistive. Teachers and schools should moderate outputs and retain professional responsibility, especially for high-stakes decisions.
What should our DPO or network manager review?
Request processing records, data-flow diagrams, subprocessors and locations, retention schedules, DPA/DPIA evidence, penetration-testing and incident procedures, access controls, safeguarding protocols, and any certification documents.