Understand our security requirements, what each service needs to demonstrate, and how to ask for the evidence.
Try an example to see what a service needs to demonstrate. These explain our requirements; they are not results from a security assessment.
Information and access
A review must check that people can reach only the information and actions they are permitted to use.
Choose either request, then move through the stages.
The request needs an identity and a defined scope. Signing in alone does not establish permission.
Illustrative requirement, not a test or verified control in an EAG service.
Student and family privacy
School, provider and family responsibilities must be settled before student information is shared. A product review follows the information through each stage.
See how purpose, access and removal rules apply.
Collected for a stated purpose
The product must establish why it needs the information and the responsibilities that apply.
Shared EAG requirements, not a live deletion demonstration.
Testing and maintenance
A finding needs a documented fix and evidence that the relevant change was checked. Material changes can require a new review.
See what each stage should add to an assessment.
Affected scope and the weakness found.
Identify the application, assessor, date, methods and limitations.
Illustrative report anatomy, not an available EAG assessment report.
A checklist or automated scan alone does not establish comprehensive security. Assessment and certification claims need verifiable scope and records. Detailed vulnerabilities stay private.
Ask about the specific service you plan to use. The level of detail should match your role and the information involved.
Understand why it is collected and how it is used.
Understand sharing, choices and privacy rights.
Find the route for privacy or safety concerns.
Review staff access and separation between schools.
Review providers, storage, retention and deletion.
Review agreements and scoped assessment records.
Each service needs responsible owners for security reports, incidents and recovery. Safeguarding, moderation and age-appropriate design need their own arrangements wherever relevant.
What the evidence needs to establish.
A provider’s report or certificate covers its stated services and scope. It does not automatically certify an EAG application. The product’s own configuration, permissions and data handling still need evidence.
A SOC 2 report or a certification claim must identify the relevant entity, system, scope and dates. We do not claim ISO 27001 or AIUC-1 certification without the actual supporting records. Ask about the specific service and the evidence relevant to your review.
Applicable privacy obligations, including GDPR where relevant, depend on the actual processing and responsibilities. School agreements and student-privacy requirements need their own review. A security report does not replace those obligations.
This website has no user accounts or payment checkout. Its contact messages, optional reactions and hosting records are described in the privacy policy. Those website-specific practices do not establish protections for a separate EAG product.
Include the service name and a short description so EAG can address the right scope. Please leave out passwords, payment details and private student records.