Your school's data is stored in the EU, encrypted, backed up daily and only accessed by people who need it. This page summarises how.
The legal detail is in our Data Processing Agreement (DPA). Everything on this page is a plain-English summary of that document and of our sub-processor list. Where the two differ, the DPA is what applies.
Application, database and files: DigitalOcean, Amsterdam, Netherlands (EU).
Backups: Amazon Web Services, Stockholm, Sweden (EU), a separate provider and region from the main servers.
We do not operate our own data centres. Both providers' facilities maintain physical access controls, including restricted access and surveillance. Teach 'n Go staff have no physical access to the servers.
In transit: all connections use TLS.
At rest: 256-bit AES encryption or stronger.
Laptops and other devices our staff use to access school data are protected by a password or biometric lock and full-disk encryption. Remote access to our systems is only permitted over encrypted, key-authenticated connections such as SSH.
Backed up at least every 24 hours.
Backups are encrypted and stored with a separate cloud provider in a separate EU region.
Backups permit prompt restoration of your data in the event of a disaster. We maintain a business continuity and disaster recovery plan so that we can resume service and restore your access after a physical or technical incident.
Teach 'n Go staff access school data only on a need-to-know basis, for example to answer a support request, and only as necessary to do their job.
Access is granted only to people a director has authorised and judged trustworthy, and only after they have signed a confidentiality agreement and completed data security training.
Every member of staff has a unique user ID and a strong password or biometric login. Passwords are never shared and are encrypted in storage.
Technical controls limit each person to the categories of data they need for their role.
Access rights are reviewed at least quarterly and whenever someone changes role. When someone leaves, their access is removed promptly and their devices are returned and wiped.
Logging is enabled on every system that stores school data, and we periodically review audit logs, access reports, privileged operations and error logs.
We engage third parties to perform network vulnerability assessments and penetration testing on a regular basis.
We maintain an up-to-date firewall and intrusion detection, and install security patches as soon as is reasonably practicable.
Changes to production systems, applications and databases follow a documented change management process.
We have a designated incident lead and documented procedures for incident response and customer communication, reviewed after every incident and at least annually.
If a personal data breach affects your school's data, we notify you without undue delay after becoming aware of it. The notice describes, as far as then known, the nature of the breach, the data subjects and records concerned, the likely consequences and the measures taken or proposed.
We keep a record of every personal data breach, including its facts, effects and the remedial action taken, and we cooperate with your investigation.
Your school is the data controller. Teach N Go Ireland is the data processor and processes your data only on your instructions or as required by law.
Our systems are designed to collect and process the minimum personal data needed to provide the service. Card details are handled by the payment provider your school connects and are not stored by Teach 'n Go.
If a student, parent or teacher makes a data subject request that you cannot handle yourself in the app, we will help you respond to it.
When your contract ends, we return, destroy or transfer your data as you direct within 60 business days. Destruction is done so that recovery would be impracticable.
We use a small number of third-party providers to run the service. Every one of them is listed on our sub-processors page, with what it does for us and where the data is processed. Each is bound by a written contract with data protection obligations at least as protective as those in our DPA, and transfers outside the EEA are covered by Standard Contractual Clauses or the EU–US Data Privacy Framework. Before we add a new sub-processor we update that page and email every school's account administrators at least 10 business days in advance.
A director of Teach N Go Ireland has overall responsibility for information security and data protection, and the security responsibilities of staff and contractors are defined in writing.
We have carried out a risk assessment of the threats to the confidentiality, integrity and availability of school data, and we review our security policies and procedures periodically and when our environment changes.
We maintain a record of processing activities as required by GDPR Article 30.
Data Processing Agreement (v2.0, effective 26 September 2026), including the Standard Contractual Clauses and the full list of technical and organisational measures in Annex II.
For security questionnaires, RFPs or anything on this page, email info[at]teachngo[dot]com. Teach N Go Ireland Limited, 60 Merrion Square South, Dublin 2, D02 HE24, Ireland.
