Security Policy – Calmcloud

Purpose

The purpose of this policy is to ensure the security, confidentiality, and integrity of all information collected, stored, and processed by the Calmcloud app. As a tool supporting children’s wellbeing in schools, Calmcloud has a responsibility to protect sensitive personal data, particularly that of minors, against unauthorized access, misuse, loss, or disclosure.

Scope

This policy applies to:

All Calmcloud data, whether stored electronically or physically.
All users, including school staff, administrators, and Calmcloud team members.
All devices and systems used to access Calmcloud data.

Objectives

The objectives of the Calmcloud app are to:

Safeguard children’s emotional and wellbeing data.
Ensure compliance with UK GDPR, Data Protection Act 2018, and safeguarding standards.
Prevent unauthorized disclosure or modification of sensitive information.
Ensure that schools, staff, and parents trust Calmcloud to securely manage data.

Roles & Responsibilities

The roles and responsibilities of the Calmcloud team are as follows:

Calmcloud Management: Ensure policies are enforced and resources allocated.
Data Protection Officer (DPO): Oversee compliance with data protection regulations and respond to data subject requests.
Developers & IT Team: Maintain secure coding practices, encryption, backups, and security monitoring.
School Staff/Users: Protect login credentials, use the system responsibly, and report any security concerns.

Key Policy Areas

5.1 Data Security

All personal data is encrypted at rest and in transit (AES-256, TLS 1.2+).
Sensitive data (children’s wellbeing inputs, emotional check-ins) is stored securely in compliance with GDPR.
Access to student data is role-based (teachers see their pupils, administrators see anonymized reports).

5.2 Access Control

Multi-factor authentication (MFA) is required for administrative access.
Passwords must meet strong complexity standards and be changed regularly.
User accounts are reviewed and disabled promptly when staff leave a school.

5.3 Acceptable Use

Users must not share login credentials.
Calmcloud may only be used for its intended educational and wellbeing purposes.
Personal devices used to access Calmcloud must have basic protections (PIN/password, lock screen, and antivirus).

5.4 Network & Infrastructure Security

Calmcloud is hosted on secure, GDPR-compliant servers within the UK.
Firewalls, intrusion detection, and monitoring tools are maintained to detect suspicious activity.
Regular vulnerability scans and penetration tests are conducted.

5.5 Incident Response

All suspected data breaches must be reported immediately to the DPO.
Calmcloud will notify affected schools and, if required, the ICO (Information Commissioner’s Office) within 72 hours.
Incident logs will be maintained and reviewed.

5.6 Business Continuity & Disaster Recovery

Encrypted backups are performed daily and tested monthly.
In the event of system failure, service restoration procedures aim to resume within 24 hours.

5.7 Compliance & Monitoring

Regular audits ensure compliance with GDPR and safeguarding standards.
All data processing agreements (DPAs) with third parties are reviewed annually.

Training & Awareness

Calmcloud staff receive annual training on data protection, safeguarding, and information security.
Schools using Calmcloud will be provided with guidance on safe use and protecting student privacy.

Enforcement

Violations of this policy may result in withdrawal of access to the Calmcloud app and its contents, contract termination, or legal action.

Review

This policy will be reviewed annually or whenever there are major changes in legislation, technology, or operational requirements.

Product

Company

Contact

Stay Connected