How we keep your data safe across The Key, GovernorHub and Robin
Schools, trusts and local authorities trust us with important information, and protecting it is central to everything we build. Our Trust & Safety Program brings together the standards, controls and people that keep your data secure, private and available. Here’s how it works.
1. Independent accreditations
- ISO/IEC 27001:2022 — The Key and GovernorHub are certified to ISO/IEC 27001:2022, the international standard for information security, independently assessed by a UKAS-accredited certification body. Robin is currently covered by ISO/IEC 27001:2022 certification held within our wider group.
- Cyber Essentials — The Key Support Services Limited (trading as The Key and GovernorHub) & Robin are certified under the UK Government’s NCSC-backed Cyber Essentials scheme and are reviewed annually, demonstrating our technical defences against common cyber threats.
2. Our digital security
- Your data lives in the cloud, not on devices — Your data is stored on our secure cloud platform rather than on individual laptops, so it stays protected even if a device is lost or stolen. Sessions log out automatically after a period of inactivity.
- Encrypted end to end — Your data is encrypted both in transit (TLS 1.2 or above) and at rest (AES-256) — protected on the move and in storage, so only authorised users can read it.
- Tightly controlled internal access — Our staff can access data only on a strict need-to-know basis. Access is least-privilege, time-limited, fully logged and protected by multi-factor authentication, and is reviewed regularly and removed promptly when no longer needed.
- Round-the-clock monitoring — We continuously monitor our systems for security events, supported by a specialist 24/7 Security Operations Centre, with protection against web-based and denial-of-service attacks.
- Built and tested securely — Our products are developed to recognised secure-coding standards (OWASP), with peer code review, automated security and vulnerability scanning, prompt patching, and independent penetration testing by a CREST-approved provider at least once a year.
3. Resilience and business continuity
- Immutable backups — We keep immutable, encrypted backups. Backup restores are tested regularly.
- Tested recovery plans — We maintain and regularly exercise a business-continuity and disaster-recovery plan.
4. Incident response
- Ready to respond — We have a documented incident response plan, tested through regular exercises, with trained incident leads and specialist external support available around the clock.
5. Our physical security
- Secure data centres — Our platforms are hosted in secure data centres run by leading cloud providers (Google Cloud and Amazon Web Services), which hold their own internationally recognised security certifications and 24/7 physical protection.
- Our offices — Our own premises are managed offices with controlled access, CCTV and alarm systems.
6. Our people
- Trusted, trained and vetted — Everyone who works with your data is bound by confidentiality obligations, and trained in security and data protection on an ongoing basis — including regular phishing tests.
7. Governance and accountability
- Led from the top — Our Trust & Safety Program is run as a formal information security management system, led by our Group Head of IT and Information Security and our Data Protection Officer, with oversight at board level.
- Checked and improved — We carry out regular internal audits and management reviews, alongside annual external certification audits.
- Secure suppliers — We assess the security and data protection of every supplier before they handle your data.
8. Keeping your data safe together
Our products give you controls to protect your own organisation’s data:
- Manage who has access — Role-based permissions let you decide who sees what, and administrators can add or remove users and send password resets at any time.
And some simple habits that make a big difference:
- Use a strong, unique password — ideally stored in a password manager — and turn on multi-factor authentication. Never share your login.
- Be alert to phishing: check before you click, and report anything that looks suspicious.
- Keep access up to date — remove people who have left your organisation promptly.
- Only share information through approved, secure channels, and follow your organisation’s data protection policy when using any AI tool, including the AI features in our products.
9. Trust resources and contact
- Available on request — Our ISO/IEC 27001 and Cyber Essentials certificates.
- Get in touch — For security or data protection questions, contact our Data Protection Officer at [email protected].
Last updated: 1 October 2026