Security measures at Sparx

Information on how Sparx protects school data can be found on our Security Information for Schools page. This is a pdf should you wish to download a copy for your records. Below are some of the most common additional questions about our security arrangements.

We store our data ringfenced in the EEA

Sparx uses Google Cloud Platform (GCP) for cloud computing services, including hosting our platform and storing student, teacher and parent personal data. All our user data is stored on GCP servers that are located in the European Economic Area, including back-ups. Our primary storage servers are Belgium, GCP Europe server EUROPE-WEST1. Our backups are hosted under Google's European Multi-regional bucket. This means that Google can choose which of its servers they use but it can never leave the EU. You can read more about GCP servers or 'storage buckets' here.

All application data is encrypted at rest and is transmitted encrypted using https for secure communication. Cryptographic keys are stored securely under carefully restricted access and secrets are rotated periodically.

We are refreshing our security accreditation

Sparx previously held Cyber Essentials Plus. We took the decision not to renew as but as schools are increasingly recognising security accreditation, we are currently re-certifying.

Back-ups run nightly

For both school and usage data.

We have never had a data breach notifiable to the ICO

Sparx has never had a breach notifiable to the ICO across any of its products. We have internal data protection policies and procedures in place that provide clear instructions to Sparx employees on the standards expected of them when processing personal data and which include a clear process for employees to follow in the event of a personal data breach.