Trusted with the important stuff.
The Foundations
Boring on purpose.
You're holding children's medical details and parents' money. This is the one page where we're allowed to be dull.
Tenant isolation, enforced in the database
Every school is a separate tenant, walled off with Postgres Row Level Security. The isolation lives in the database itself - not in application code that a bug could route around.
Card details never touch us
Payments run through Stripe, a certified PCI DSS Level 1 provider. Card numbers go from the parent's browser to Stripe directly; our servers never see or store them.
Encrypted everywhere
TLS 1.2+ for every connection, AES-256 encryption at rest. Server-side secrets stay server-side - they are never shipped to the browser.
UK GDPR by design
Data is processed under UK GDPR with clear lawful bases. Medical and SEND information is treated as special category data, visible only to the staff who need it poolside.
Backups you'll never think about
Continuous, encrypted backups with point-in-time recovery, hosted on Supabase infrastructure in tier-one data centres.
Least-privilege access
Role-based permissions across parent, teacher, admin, and platform staff. Support impersonation is explicit, logged, and auditable - never silent.
Plain English
Five promises, no lawyer required.
Your data is yours - export everything as CSV, any time, free.
We never sell, share, or mine your families' data. Our only revenue is your subscription.
Delete your account and we delete your data, keeping only what law requires us to retain.
Parents' payment details live with Stripe, not with us - leaving is as safe as staying.
We tell you about any incident affecting your data promptly and plainly, not in paragraph nine of an email.
Found a vulnerability?
We take responsible disclosure seriously and respond to every report. Tell us before you tell the internet, and we'll credit you when it's fixed.
security@octoswim.co.ukQuestions our security page didn't answer?
Ask us directly - we'll put a straight answer here for the next school that asks.