Security and trust

Our server functions run in the Vercel London region (lhr1). Some services we use are based outside the UK, including in the United States. Our Privacy Policy lists them and where they process data.

A Data Processing Agreement is available on request, with sub-processor and country-of-processing list. If your procurement team needs to confirm exact-region residency in writing before signing, the DPA carries that detail.

Awarding-body API keys and integration credentials are encrypted in our database with AES-256-GCM. Passwords are stored only as bcrypt hashes (cost factor 10 or higher), never as readable text. All traffic uses HTTPS.

Headers and transport. Every page carries a Content-Security-Policy. It stops other sites from showing our pages inside a frame (frame-ancestors 'none') and limits where scripts can load from. HTTP Strict Transport Security is set for one year and covers subdomains (max-age=31536000; includeSubDomains), so browsers that have visited us once will not downgrade to plain HTTP. X-Content-Type-Options: nosniffstops browsers guessing a file’s type from its contents. These headers apply platform-wide, not just on this page.

Every account can use two-step sign-in (MFA) with a code from an authenticator app. A manager can make it compulsory for all staff in Settings, under SSO & sign-in. Anyone who uses two-step sign-in is asked for a new code after 8 hours.

The sign-in cookie is encrypted. Staff are signed out when their organisation’s session length runs out, counted from when they signed in. A manager chooses 1, 4, 8, 12 or 24 hours. The default is 8 hours. Learners are signed out after 24 hours without using the platform.

Sign-ins, including failed attempts, are written to the audit log. So are password changes, temporary passwords set by staff, and the start and end of each “View as student” session.

We provide a Data Processing Agreement on request, including the sub-processor list and country-of-processing detail. A DPIA summary suitable for inclusion in your procurement file is available on the same request.

Miles is powered by Anthropic Claude (Anthropic API, EU-fronted via Vercel AI Gateway). Per-request Zero Data Retention is set on every Miles call routed via Vercel AI Gateway, so learner inputs and model responses for these calls are not retained at the gateway layer. Anthropic’s standard commercial API terms also bind: learner inputs are not used to train Anthropic’s models.

Miles is formative only. It asks adult learners questions rather than giving them answers, never marks summative work, never determines a learner’s level, and is always supervised by the learner’s tutor. Tutors and Quality Managers see every Miles interaction in the audit log.

A Data Processing Agreement is available on request, including the sub-processor list and country-of-processing detail. We are working through the additional defence-in-depth steps listed in What’s still in progress below.

Every release walks our 3-light pre-ship gate: a real-user functional walk, an automated test suite, and a brand-fidelity review. Two of three is no-go. The platform you book a demo on this week is the platform your learners will sign into next week.

Database migrations are reviewed before deploy. Deploys that touch authentication, audit-log writes, or assessment scoring get an extra accessibility-and-pedagogy review pass before shipping.

We are working through Cyber Essentials. We will publish the certification number on this page once issued. ISO 27001 is not currently held; we will only claim it once held. SOC 2 is not in scope for our current customer base; if your procurement requires it, talk to us during the demo and we will document the path.

We do not list certifications we do not hold as marketing badges. Roadmap items live here, in prose.

We hold transparency on our security roadmap. Here’s what is shipping next, in priority order:

1. Team-level Zero Data Retention enforcement. Per-request ZDR is already set on every Miles call (see Miles — formative Socratic tutor above). The team-level dashboard toggle adds defence-in-depth so the configuration is enforced at the gateway team layer as well as per call. Not yet confirmed at the team layer; this page will say so when it is.
2. Audit log and evidence packs (already available). Pathway Skills already writes an audit log of every settings change, authentication event, bulk action, and Miles interaction. You can read the log in Settings, under Audit log. A manager can download it from Settings, under Export & retention. Each learner already has an evidence pack, a PDF of their record. A manager, or a tutor assigned to that learner, can request it from the learner’s page.
3. Cyber Essentials certification. We are working through Cyber Essentials. We will publish the certification number on this page once issued. ISO 27001 is not currently held; we will only claim it once held.
4. Data Processing Impact Assessment summary. A DPIA summary suitable for inclusion in your provider’s procurement file is available on request alongside the Data Processing Agreement.

If a procurement deadline depends on any of these, tell us in the demo and we will share the current state in writing.

For security questions, vulnerability disclosure, or DPO-to-DPO correspondence, email help@pathway-skills.com. We aim to respond within 2 working days.

For accessibility-specific issues, see the Accessibility Statement.

Some apprentices on Pathway Skills are aged 16 or 17. The ICO Age Appropriate Design Code (the Children’s Code) applies to any service likely to be accessed by under-18s.

Best interests first. Pathway Skills is paid for by the training provider, not by the learner. There is no advertising, no in-app purchasing, and no algorithm designed to keep a learner on the platform longer than their study plan requires. Design choices that benefit the learner — clarity, calm, no surveillance framing — also benefit the provider buying the service.

No detrimental use. We do not use learner data for targeted advertising, engagement-exploitation profiling, or any purpose shown to be detrimental to learner wellbeing. Miles is positioned as a Socratic tutor support, not a substitute for the tutor (see section 7 above).

Starting settings. Every learner starts with the same privacy and notification settings, whatever their age. We do not currently give under-18s more private starting settings, even when their date of birth is on record.

Our full AADC self-audit covering all 15 standards is available on request alongside the DPA.

We uphold our published policies. Where we deviate from a control we have committed to — for example a temporary operational exception during onboarding — we log it in an internal exception register with a remediation date and a named owner.

Our published policies you may want to read alongside this page: the Privacy Policy, the Accessibility Statement, and the cookie-consent surface presented on first visit.

The ICO Age Appropriate Design Code asks services not to use nudge techniques to lead or encourage children to provide unnecessary personal data, turn off privacy protections, or extend their use of the service.

Inside the platform, the bell icon can show study prompts, such as a topic where the learner’s practice scores are low. We do not send reminder, mock exam or weekly recap emails yet. Each has its own setting, and we keep the learner’s choice for when we do. We do not use countdown timers on consent dialogs, “are you sure?” double-confirms on privacy-reducing actions, or dark-pattern friction designed to discourage learners from changing a setting. The learner home page shows a study streak and milestones. There are no points and no leaderboards.

Notification settings start the same for every learner, including under-18s.

Pathway Skills is a web platform. We do not ship connected toys, smart devices, wearables, or any hardware. The Age Appropriate Design Code standard 14 is therefore not applicable to us. If we ever introduce a paired hardware component — we have no plans to do so — we will re-run the AADC self-audit before launch and update this section.

You can exercise any of your data protection rights under the UK GDPR at any time. The current route is to email our DPO at help@pathway-skills.com. There is no self-service download yet.

• See your data. A subject access request returns a copy of the personal data we hold about you. We respond within one calendar month.
• Correct your data. If something is wrong, ask your tutor or email us directly. You can change your name, preferred name and phone number yourself on your profile page.
• Delete your data. You can ask us to delete your data. Where your records are kept under a funding-rule legal obligation — typically while your training is live and for a retention period after — we will explain what we can delete now and what we are required to keep, with the reason in writing.
• Take your data with you. You can request a copy of the data you provided to us in a structured machine-readable format.
• Object or restrict. You can object to certain kinds of processing or ask us to restrict what we do with your data while a question is being worked through.
• Complain to the regulator. If we have not handled your data well, you can complain to the ICO at ico.org.uk/make-a-complaint.

See the Privacy Policy for full detail of what we hold, why, for how long, and with whom we share it.