Required agreement
The parties must approve controller and processor roles, instructions, security, confidentiality, support, retention, deletion, audits, subprocessors and transfers.
Unavailable evidence
The repository does not verify Cyber Essentials, ISO 27001, penetration testing, insurance, UK-only hosting, backup recovery objectives or guaranteed uptime.
Product gaps
School-wide administrator tenancy, class archival, teacher transfer, school export and contract-end deletion need implementation and approval before a school-wide managed service is represented as complete.