For schools and trusts

Built to the KCSIE and DfE standard.

Custodiance runs your school or trust's web and email estate as a managed service: your data stored in UK and EU regions, built to the standard Keeping Children Safe in Education and the Department for Education require, and run by a named senior engineer you deal with directly. Safeguarding does not stop at the policy folder; neither does the way we run your infrastructure.

Request a scoping call The methodology

The risk

What KCSIE and the DfE require of your website, and where agency builds silently fail

A typical school site (independent prep and senior, SEN provider, academy, or trust) was built a few years ago on whichever SaaS stack carried a template: WordPress on a US host, an Eventbrite open-day widget, a Mailchimp parent-newsletter signup, a Facebook Pixel for the admissions campaign, and a "contact the Head" form pointing at a US-resident inbox. The site works and open-day signups come in. It also quietly fails the obligations the school, not the agency, is accountable for. Four are worth naming precisely.

KCSIE online-safety expectations

Keeping Children Safe in Education makes online safety a running theme of a school's whole-school safeguarding approach (KCSIE 2024, Part 2). The website is the public projection of that posture: the Designated Safeguarding Lead's name and contact route findable within two clicks, a clear path to report a concern, and the online-safety, filtering, and monitoring approach published. On most agency builds the DSL line is buried in admin pages and the safeguarding page is an afterthought, not part of the main navigation.

The DPA 2018 and the Children's Code

Pupil and family data carry enhanced protection under the Data Protection Act 2018 and UK GDPR. The ICO's Age-Appropriate Design Code (the Children's Code) applies to online services likely to be accessed by children (the school's own website is precisely that), and Standard 7 requires settings to be high-privacy by default. A Facebook Pixel loading on a page that names a Year 8 pupil fails Standard 7 silently: the default is data-sharing with a US ad network, with no consent, on a page the child may access themselves.

Pupil and family data on US infrastructure

The admissions enquiry form, the open-day booking widget, and the parent newsletter typically run on US-resident SaaS (HubSpot, Eventbrite, Mailchimp), holding child names, dates of birth, year groups, and sometimes SEN context. US-resident services are subject to the US CLOUD Act, and the CJEU's Schrems II ruling made bulk transfer of this data legally precarious. For children's data the bar is higher again, and it is exactly the cross-border posture the ICO has said it expects organisations to avoid.

The school as data controller

The school, not the agency, is the data controller. That means Article 30 records of processing, Article 28 data-processing agreements with every sub-processor, and a lawful transfer mechanism (Standard Contractual Clauses plus a Transfer Risk Assessment) for any data flowing outside the UK and EU. Layered over this is image consent: no identifiable child should appear on the site without recorded, granular, withdrawable parental consent, and most sites carry photos the original consent no longer covers.

None of these obligations explicitly requires a website hosted in the UK or the EU. Each, however, eventually asks the same question: where does the pupil and family data live, who has access, and can the school prove it? On a typical agency-built site the honest answer is "the agency set it up; we do not really know."

How Custodiance answers it

An estate held to your regulator's standard

The work that puts a school's site right is not a one-off remediation. It is the work the estate carries continuously, mapped to the KCSIE and DfE obligations a school is accountable for.

A managed estate, not a finished project

Your web and email infrastructure is run as an estate we hold continuously (audited, monitored, and changed on your behalf), not handed over once and left to decay. Admissions intake, open-day bookings, the parent newsletter, analytics, the safeguarding page, and the KCSIE policy index are kept correct as the guidance and your school evolve, so the annual-review dates do not slip between inspections.

UK and EU data residency by design

Hosting is pinned to Vercel's London region in each project's configuration. Admissions and contact forms post to the estate's own endpoint and are relayed by Scaleway in France to the school's own mailbox, in your Microsoft 365 or Google Workspace tenant or at Proton in Switzerland, a country the UK and EU recognise as adequate. Open-day bookings run on a booking tool in the school's own name, chosen for UK or EU residency, with retention tied to the event date; the parent newsletter runs on an EU platform, MailerLite in Lithuania, with double opt-in; where you want analytics, they run on our own Plausible Community Edition server in France, without cookies. The US-incorporated providers that stay in the path, Vercel for hosting, GitHub for the source code and Cloudflare for DNS, are named in the published sub-processor list as exceptions. When a safeguarding governor, a data-aware parent, or an inspector asks where the pupil and family data lives, the answer is written down, not assumed.

Sub-processor list · Data processing agreement

Built to a published methodology

The standard each estate is built to is written down and applied consistently, so the way your school is built is the way the next one is: auditable, repeatable, and defensible rather than improvised per project. The DSL contact pattern, the image-consent register, and the KCSIE policy architecture are part of that posture, set out in the Custodiance framework.

A named senior engineer

One senior technical partner runs your estate: a name and a direct line, not a ticket queue. That engineer understands your KCSIE and DfE obligations, does the work between requests, and is the person you speak to when a governor or an inspector asks.

Read the evidence

The detail, set out in full

Two briefings work through the specifics (the safeguarding-and-residency posture and the KCSIE publication checklist) requirement by requirement, with the statutory text quoted and sourced.

Why your UK school's website probably fails KCSIE

The KCSIE Four: admissions and parent forms on US infrastructure, open-day booking widgets such as Eventbrite holding pupil year-group data in US databases, parent newsletters mailing from US servers with year-group tags, and tracking pixels loading on pages that name pupils. Set against KCSIE 2024 online-safety expectations and the Children's Code Standard 7, with the DSL-contact pattern and the image-consent question a regulated-grade estate puts right.

Read the briefing →

KCSIE-aligned school website audit: the 2026 checklist

The eight KCSIE requirements that name the website as the place information must be published: safeguarding policy and named contacts, the Prevent duty and risk assessment, behaviour and exclusions, the SEN information report, complaints, online safety, and the child-protection policy. Each with its audit-pass marker, the concrete fix, and the markup pattern Ofsted checks during pre-inspection desk research.

Read the briefing →

Engage

How to run the estate

Growth

Quoted per practice After a scoping call, confirmed in writing

For an established practice that wants its web and email estate run properly, in UK and EU regions, by a named technical partner.

Managed web + email infrastructure
Built to your regulator's standard
UK and EU data residency, exceptions named
A named technical partner
Continuous monitoring + changes

Custody, not marketing.

Have a senior partner review your estate against the KCSIE and DfE standard

A scoping call is a measured conversation about your obligations, your current setup, and what it would take to run it properly. The eight KCSIE publication requirements and the four residency failures above are reviewed against your live site and marked pass, partial, or fail, with the specific remediation for each. No obligation, and no pressure.

Request a scoping call See pricing