Procurement evidence pack

1Legal entity

SoloCogs is the brand name for the online learning platform operated by Portsdown Tuition, a sole-trader business based in Portsmouth, England. The operator and contracting entity for any procurement is Portsdown Tuition; SoloCogs is the service / product brand. The data controller for personal data processed through SoloCogs is Portsdown Tuition.

Trading name

SoloCogs

Operator (legal entity)

Portsdown Tuition (sole trader)

Founder / Operator

Jazz McCullough

Registered address

Portsmouth, England, UK

HMRC registration

Sole-trader self-assessment, current

If a procurement form requires a Ltd company, please flag this at the conversation stage - incorporation is on the roadmap.

2Insurance

SoloCogs is insured for SaaS delivery and school procurement use. Cover is active through Hiscox (arranged via PolicyBee) and includes professional indemnity, cyber liability, and public liability protection.

Professional Indemnity

£2,000,000 Active

Cyber Liability

£500,000 Active
Covers breach response, ICO investigations, ransomware, and customer notification.

Public Liability

£1,000,000 (current + renewing) Active

Employers' Liability

Not required (sole trader, no employees). Will be added the day any employee or contractor starts.

Retroactive date

1 September 2025 (date trading commenced).

Insurer

Hiscox UK (via PolicyBee broker).

3Data controller + Designated Safeguarding Lead

Data Controller

Portsdown Tuition (Jazz McCullough). A Data Protection Officer (DPO) is not legally required for an organisation of this size; responsibility rests with the data controller directly.

Designated Safeguarding Lead

For school-tier tenants, the school's own DSL owns disclosures - SoloCogs does not substitute for a statutory DSL. For direct family / home-education tenants, Jazz McCullough acts as DSL (qualified teacher, current DBS, NSPCC Level 3 Safeguarding refresh 2026), with a named Deputy DSL providing cover. Full flow in Section 7.

Statutory contact

hello@solocogs.co.uk

ICO registration

Registered as a data controller with the UK Information Commissioner's Office. Registration number ZB916444 - searchable on the ICO public register.

4Data residency

All student, parent and staff personal data is stored within the United Kingdom or European Economic Area. No data is processed in or transferred to a third country without an adequacy decision or Standard Contractual Clauses in place.

Primary database region

Supabase EU West (London, United Kingdom)

Object storage region

Supabase EU West (London, United Kingdom)

Backups

Same region. Point-in-time recovery active.

Edge Function execution

EU West region only.

5Sub-processors

The third parties listed below either process personal data on behalf of Portsdown Tuition under written data-processing agreements, or are named as planned sub-processors pending contract completion. All entries are GDPR-compliant and located within or providing services to the UK / EEA.

Supabase Inc.

Database, authentication, object storage, Edge Functions. UK / EU region. DPA

Resend

Transactional email (weekly digest, password resets, account notifications). EU region. DPA

Google Analytics 4

Opt-in only via the cookie banner. No PII transmitted. IP anonymisation enabled. Privacy

Google Tag Manager

Tag delivery for the analytics opt-in only. No data processed without explicit consent.

Wonde Planned

MIS integration broker for school-tier customers. Software-partner application in progress; no data flow until partner status is granted, the DPA is signed, and each school independently authorises access. Scopes requested at minimum for enrolment: students, teachers, classes, class memberships. Full MIS data-usage reference · Wonde security

jsDelivr CDN

Static asset delivery (CSS / JS libraries only - no personal data transits).

No advertising, marketing, or analytics sub-processor receives any personal data without explicit opt-in consent.

6DPIA + GDPR documentation

Full GDPR and data-protection documentation is published. Procurement officers needing additional supporting evidence (sub-processor agreements, processor due-diligence, breach playbook) can request via the contact email.

• Data Protection Impact Assessment (DPIA) - the formal risk analysis
• GDPR + Data Residency one-pager - executive summary
• Data Protection Policy - operational policy
• Privacy Policy - the public-facing statement
• Cookie Policy
• Data Subject Rights process - how DSARs, deletion, rectification requests are handled
• Incident Response Runbook - 72-hour ICO notification flow + breach playbook

Children's Code (AADC): internal self-audit against all 15 ICO Age Appropriate Design Code standards is on file (13 Strong / 1 Not Applicable / 1 minor enhancement remaining). Available on request.

7Safeguarding disclosure flow

SoloCogs runs an automated detection layer on every free-text answer, Cogs query, and Zone-of-Regulation reflection. Matched concerning content writes a row to the safeguarding_concerns table for human review. SoloCogs does not replace the school's Designated Safeguarding Lead: for school-tier customers, the school's own DSL owns the disclosure and SoloCogs routes concerns to them. This mirrors how any other classroom software supports (rather than substitutes) statutory safeguarding duties under Keeping Children Safe in Education 2024.

School-tier tenants

DSL of record

The school's own DSL, named and email-captured at tenant onboarding. SoloCogs supports; it does not act as your DSL.

Routing

Matched content lands in the school's staff-dashboard safeguarding queue only. RLS-isolated by tenant - one school never sees another school's queue.

Escalation

Follows the school's own KCSIE flow. The DSL decides on MASH / LADO / other statutory referral per their local safeguarding partnership.

Direct family / home-education tenants

DSL of record

Jazz McCullough (qualified teacher, DSL-trained, DBS-current, NSPCC Level 3 refresh 2026). A named Deputy DSL provides cover for holidays and absence.

Routing

Matched content lands in the operator queue for DSL review.

Escalation

Portsmouth MASH (Multi-Agency Safeguarding Hub) for pupil disclosures. LADO for allegations against adults working with children. NSPCC / 999 for immediate risk.

Both tenant types

Detection

Built-in trigger list (self-harm, abuse, distress, substance, other categories) plus tenant-specific custom triggers (schools can add their own slang / local terms). Phonetic + fuzzy matching catches deliberate misspellings and TikTok-style euphemisms.

Triage SLA

High-severity: same calendar day. Medium: within 48 hours. Low: weekly review.

Human review

No automated safeguarding action is ever taken. Every matched item is reviewed by a human DSL.

Tenant isolation

RLS policies on safeguarding_concerns ensure cross-tenant invisibility. Audit-grade.

Audit trail

Status transitions logged (open / in-review / resolved / escalated / false-positive) with reviewer + resolution note.

Full Safeguarding Policy → · Safeguarding flow diagram →

8Data retention + Data Subject Rights

Active account retention

Personal data retained for the life of the subscription / school contract.

Soft-delete window

30 days. A deleted account is recoverable for 30 days then purged.

Backup retention

Point-in-time recovery: 7 days. Snapshot retention: 30 days. All purged on schedule.

Data Subject Access Request (DSAR)

Response within 30 days per UK GDPR. Submit via hello@solocogs.co.uk.

Right to erasure

Self-serve account deletion from Family settings + Account settings. Cascades to all linked data including child accounts.

Right to portability

CSV export of every quiz attempt, RP submission, Knowledge Check and accessibility-usage record via the parent / staff dashboard.

9Pricing

Per-seat bands are published openly on the pricing page. Quotes for non-standard cohort sizes (e.g. above 500 seats), AP / EOTAS providers, or PRU settings are available on request.

• Pricing page - per-seat bands at 50 / 100 / 250 / 500 + tutor-provider tier
• Quote contact: hello@solocogs.co.uk with seat count + setting type

10Curriculum coverage

SoloCogs covers AQA GCSE across Biology (8461), Chemistry (8462), Physics (8463) and Combined Science: Trilogy (8464), at both Foundation and Higher tier, plus Key Stage 3. Required Practicals are delivered as virtual labs across every unit. Triple / Separate Science content is built across all three sciences; a small number of sub-units remain under depth verification against the Triple spec ahead of full public launch.

Full AQA Spec Coverage Matrix →

11Technical security & resilience

The platform is built on industry-standard managed infrastructure. The summary below maps to the most common procurement questions; we will provide additional evidence (architecture diagram, BCP, penetration-test scope) on request.

Encryption in transit

TLS 1.3 enforced across all surfaces. HSTS preload. CSP headers active (see /_headers for full policy).

Encryption at rest

AES-256 server-side encryption for both database and object storage (Supabase-managed).

Authentication

Supabase Auth with bcrypt password hashing. Multi-factor authentication (MFA) available on parent / tutor / admin accounts via the account-settings page (TOTP / authenticator app).

Access control

Row-Level Security (RLS) policies on every table containing personal data. Tenant isolation enforced at the database layer for school-tier customers.

Audit logging

All sign-ins, password changes, role changes, deletions, and safeguarding triage actions are logged with timestamp + actor for at least 1 year.

Backups

Point-in-time recovery (7 days) plus 30-day snapshot retention. Backups encrypted at rest in the same UK / EU region.

Vulnerability management

GitHub Dependabot alerts + security updates enabled on the source repository (private). Critical vulnerabilities triaged within 24 hours.

Cyber Essentials

On the roadmap (target Q3 2026). Self-assessment evidence available now; certified status will be promoted to procurement teams on issue.

Penetration testing

OWASP ZAP scans run against staging. External CHECK-listed pen test scheduled prior to first paid school deployment.

Service availability

Hosted on managed regional infrastructure with 99.9% target uptime. Status page on the roadmap; incidents reported within the breach-playbook timeline.

Incident response

Documented runbook with 72-hour ICO notification flow + affected-data-subject communication template. See full runbook.

12Contact

Procurement enquiries

hello@solocogs.co.uk

Response SLA

Within 2 working days. School / MAT enquiries get a 30-minute scoping call within 1 working week.

Technical / DPO queries

Same address. Routed to the data controller directly.

Safeguarding queries

Same address. Routed to the DSL.