Data protection, answered for your DPO.

In the UK. The Sendix app, its database and its backups run in Microsoft Azure UK South. For analysis, minimised passages of the plan and reports go to an AI model on Amazon Bedrock in AWS London. Bedrock doesn’t keep the inputs or outputs for the model we use, and they aren’t used for training.

Our DPA lists the sub-processors: Microsoft Azure, AWS Bedrock and AWS SES, all processing in the UK. Suppliers may give support from outside the UK under their own terms. This website is hosted in West Europe and never handles pupil data.

In the app, no one. Plan text is visible only to your school’s SENCOs and SEND leads, your trust’s SEND lead, and SEND assistants on the plans assigned to them. IT leads, billing administrators, staff at other schools and Sendix administrators can’t see it. Multi-factor authentication is mandatory for SENCO and SEND lead accounts.

Underneath the app, one person at Sendix, the founder, holds administrative access to our Azure infrastructure, which could reach the database. We don’t use it to read plan text, and individual database queries are not logged. The full answer, including break-glass, is in the assurance pack.

Only on your school’s instructions, under a data processing agreement (DPA). Someone your organisation has authorised signs the DPA in the Sendix app, and we countersign it. Real plans can be uploaded only by an organisation with a countersigned DPA that we have released for real plans. Until our independent penetration test is complete, we release no more than 3 organisations, and only when we hold a current Cyber Essentials certificate, each only after its data protection officer accepts in writing that the test is still to come.

Your staff add plans and reports as they are. Sendix removes the pupil’s name, pupil number, NHS number, postcode and labelled full dates of birth before an AI model sees the text. The walkthrough uses a fictional plan.

Nothing goes to families from Sendix. It’s a tool for school staff: its emails go to staff, and its drafts and exports go to the staff who use them. Any change to an EHCP goes through the council, which consults the family before amending the plan.

Your school is the controller, so your own privacy notice tells families how their information is used. Here is a model paragraph (v2, 6 November 2026) for your DPO to adapt and approve:

We use Sendix, a service from Sendix AI Ltd, to help our staff prepare for reviews. Sendix reads the plan, reports and staff notes, sets out evidence about each outcome and suggests next steps. A member of staff checks everything and decides; Sendix makes no decisions about your child. Sendix removes your child’s name, pupil number, NHS number, postcode and labelled full dates of birth before an AI model sees the text. Information is kept in the UK and is not used to train AI systems. Sendix acts only on our instructions, under a written data processing agreement, and the information is deleted on our retention schedule: [period]. Questions: [DPO name and contact details].

Yes, for Scottish IEPs. It checks each target against Education Scotland’s IEP guidance and suggests measurable wording built only from the plan, leaving gaps for your team. See a worked example on the IEP review page.

Until our independent penetration test is complete, no more than 3 organisations use real plans. We’re also adding organisations carefully, a few at a time, so each one gets close support. During the pilot your staff check every suggestion, and we report how many they accepted and rejected.

During it, a daily job deletes records when your retention period ends. At the end of the contract you choose whether we return your data in a commonly used format, delete it, or both. We do that within 30 days and confirm deletion in writing, unless the law requires us to keep it. Deleted records leave our encrypted backups, which stay in UK South, within 35 days.