Procurement evidence pack

1Legal entity

SoloCogs is the brand name for the online learning platform operated by Portsdown Tuition, a sole-trader business based in Portsmouth, England. The operator and contracting entity for any procurement is Portsdown Tuition; SoloCogs is the service / product brand. The data controller for personal data processed through SoloCogs is Portsdown Tuition.

Trading name

SoloCogs

Operator (legal entity)

Portsdown Tuition (sole trader)

Founder / Operator

Jazz McCullough

Registered address

Portsmouth, England, UK

HMRC registration

Sole-trader self-assessment, current

If a procurement form requires a Ltd company, please flag this at the conversation stage - incorporation is on the roadmap.

2Insurance

SoloCogs is insured for SaaS delivery and school procurement use. Cover is active through Hiscox (arranged via PolicyBee) and includes professional indemnity, cyber liability, and public liability protection.

Professional Indemnity

Active

Cyber Liability

Active

Public Liability

Active

Employers' Liability

Not required (sole trader, no employees). Will be added the day any employee or contractor starts.

Insurer

Hiscox UK (via PolicyBee broker).

Limits and certificate

Provided to a named procurement contact on request: email hello@solocogs.co.uk.

3Data controller + Designated Safeguarding Lead

Data Controller

Portsdown Tuition (Jazz McCullough). A Data Protection Officer (DPO) is not legally required for an organisation of this size; responsibility rests with the data controller directly.

Designated Safeguarding Lead

For school-tier tenants, the school's own DSL owns disclosures - SoloCogs does not substitute for a statutory DSL. For direct family / home-education tenants, Jazz McCullough acts as DSL (qualified teacher, current DBS, NSPCC Level 3 Safeguarding refresh 2026), with cover during any planned absence of more than 5 working days from a named, DBS-checked, DSL-trained safeguarding partner (there is no permanently appointed Deputy DSL). Full flow in Section 7.

Statutory contact

hello@solocogs.co.uk

ICO registration

Registered as a data controller with the UK Information Commissioner's Office. Registration number ZB916444 - searchable on the ICO public register.

4Data residency

All student, parent and staff personal data is stored within the United Kingdom or European Economic Area. No data is processed in or transferred to a third country without an adequacy decision or Standard Contractual Clauses in place.

Primary database region

Supabase EU West (London, United Kingdom)

Object storage region

Supabase EU West (London, United Kingdom)

Backups

Same region (London). Daily backups, kept for 7 days.

5Sub-processors

The third parties listed below either process personal data on behalf of Portsdown Tuition under written data-processing agreements, or are named as planned sub-processors pending contract completion. All entries are GDPR-compliant and located within or providing services to the UK / EEA.

Supabase Inc.

Database, authentication, object storage, Edge Functions. UK / EU region. DPA

Resend

Transactional email (weekly digest, password resets, account notifications). EU region. DPA

Google Analytics 4

Analytics cookies are set only after opt-in via the cookie banner. Until consent is given, Google's consent mode runs with storage denied: it sets no cookies, but can send cookieless measurement signals. No PII transmitted. Privacy

Google Tag Manager

Tag delivery for analytics. Analytics cookies are set only with explicit consent.

Wonde Planned

MIS integration broker for school-tier customers. Software-partner application in progress; no data flow until partner status is granted, the DPA is signed, and each school independently authorises access. Scopes requested at minimum for enrolment: students, teachers, classes, class memberships. Full MIS data-usage reference · Wonde security

jsDelivr CDN

Static asset delivery (CSS / JS libraries only - no personal data transits).

No advertising, marketing, or analytics sub-processor receives any personal data without explicit opt-in consent.

6DPIA + GDPR documentation

Full GDPR and data-protection documentation is published. Procurement officers needing additional supporting evidence (sub-processor agreements, processor due-diligence, breach playbook) can request via the contact email.

• Data Protection Impact Assessment (DPIA) - the formal risk analysis
• GDPR + Data Residency one-pager - executive summary
• Data Protection Policy - operational policy
• Privacy Policy - the public-facing statement
• Cookie Policy
• Data Subject Rights process - how DSARs, deletion, rectification requests are handled
• Incident Response Runbook - 72-hour ICO notification flow + breach playbook

Children's Code (AADC): internal self-audit against all 15 ICO Age Appropriate Design Code standards is on file (13 Strong / 1 Not Applicable / 1 minor enhancement remaining). Available on request.

7Safeguarding disclosure flow

SoloCogs runs an automated detection layer on every free-text answer, Cogs query, and Zone-of-Regulation reflection. Matched concerning content writes a row to the safeguarding_concerns table for human review. SoloCogs does not replace the school's Designated Safeguarding Lead: for school-tier customers, the school's own DSL owns the disclosure and SoloCogs routes concerns to them. This mirrors how any other classroom software supports (rather than substitutes) statutory safeguarding duties under Keeping Children Safe in Education.

School-tier tenants

DSL of record

The school's own DSL, named and email-captured at tenant onboarding. SoloCogs supports; it does not act as your DSL.

Routing

Matched content lands in the school's staff-dashboard safeguarding queue only. RLS-isolated by tenant - one school never sees another school's queue.

Escalation

Follows the school's own KCSIE flow. The DSL decides on MASH / LADO / other statutory referral per their local safeguarding partnership.

Direct family / home-education tenants

DSL of record

Jazz McCullough (qualified teacher, DSL-trained, DBS-current, NSPCC Level 3 refresh 2026). During any planned absence of more than 5 working days, cover comes from a named, DBS-checked, DSL-trained safeguarding partner; see the Safeguarding Policy for shorter absences.

Routing

Matched content lands in the operator queue for DSL review.

Escalation

Portsmouth MASH (Multi-Agency Safeguarding Hub) for pupil disclosures. LADO for allegations against adults working with children. NSPCC / 999 for immediate risk.

Both tenant types

Detection

Built-in trigger list (self-harm, abuse, distress, substance, other categories) plus tenant-specific custom triggers (schools can add their own slang / local terms). Phonetic + fuzzy matching catches deliberate misspellings and TikTok-style euphemisms.

Triage SLA

As set out in the Safeguarding Policy: high-severity within 4 working hours (or by the end of the next working day at weekends and holidays); medium and low on the tiers listed there.

Human review

No automated safeguarding action is ever taken. Every matched item is reviewed by a human DSL.

Tenant isolation

RLS policies on safeguarding_concerns ensure cross-tenant invisibility. Audit-grade.

Audit trail

Status transitions logged (open / in-review / resolved / escalated / false-positive) with reviewer + resolution note.

Full Safeguarding Policy → · Safeguarding flow diagram →

8Data retention + Data Subject Rights

Active account retention

Personal data retained for the life of the subscription / school contract.

Soft-delete window

30 days. A deleted account is recoverable for 30 days then purged.

Backup retention

Daily backups, kept for 7 days, then purged on schedule.

Data Subject Access Request (DSAR)

Response within 30 days per UK GDPR. Submit via hello@solocogs.co.uk.

Right to erasure

Self-serve account deletion from Family settings + Account settings. Cascades to all linked data including child accounts.

Right to portability

A copy of a student's personal data is provided in a portable format on request (see Data Subject Access Request above). Staff dashboards also export assessment results as CSV.

9Pricing

Per-seat bands are published openly on the pricing page. Quotes for non-standard cohort sizes (e.g. above 500 seats), AP / EOTAS providers, or PRU settings are available on request.

• Pricing page - per-seat bands at 50 / 100 / 250 / 500 + tutor-provider tier
• Quote contact: hello@solocogs.co.uk with seat count + setting type

10Curriculum coverage

SoloCogs covers AQA GCSE across Biology (8461), Chemistry (8462), Physics (8463) and Combined Science: Trilogy (8464), at both Foundation and Higher tier, plus Key Stage 3. The Required Practicals have virtual labs, for rehearsal alongside the practical in class. Triple / Separate Science content is built across all three sciences; a small number of sub-units remain under depth verification against the Triple spec ahead of full public launch.

Full AQA Spec Coverage Matrix →

11Technical security & resilience

The platform is built on industry-standard managed infrastructure. The summary below maps to the most common procurement questions; we will provide additional evidence (architecture diagram, BCP, penetration-test scope) on request.

Encryption in transit

TLS 1.2 or higher on all surfaces. HSTS with preload. CSP headers active (see /_headers for full policy).

Encryption at rest

AES-256 server-side encryption for both database and object storage (Supabase-managed).

Authentication

Supabase Auth with bcrypt password hashing. Multi-factor authentication (MFA) available on parent / tutor / admin accounts via the account-settings page (TOTP / authenticator app).

Access control

Row-Level Security (RLS) policies on the tables containing personal data. Tenant isolation enforced at the database layer for school-tier customers.

Audit logging

Sign-ins and account changes are logged by the authentication provider. Safeguarding triage actions are logged with timestamp, reviewer and resolution note.

Backups

Daily backups, kept for 7 days, encrypted at rest in the same London region.

Vulnerability management

GitHub Dependabot alerts + security updates enabled on the source repository (private). Critical vulnerabilities are prioritised for immediate triage.

Cyber Essentials

Self-assessment in progress; formal certification is targeted before commercial school rollout. Not yet certified.

Penetration testing

Not yet carried out. An external CHECK-listed penetration test is planned before the first paid school deployment.

Service availability

Hosted on managed regional infrastructure with 99.9% target uptime. Status page on the roadmap; incidents reported within the breach-playbook timeline.

Incident response

Documented runbook with 72-hour ICO notification flow + affected-data-subject communication template. See full runbook.

12Contact

Procurement enquiries

hello@solocogs.co.uk

Response SLA

Within 2 working days. School / MAT enquiries get a 30-minute scoping call within 1 working week.

Technical / DPO queries

Same address. Routed to the data controller directly.

Safeguarding queries

Same address. Routed to the DSL.