9ine School Application Assurance

Independent assessment for software your school builds with AI

Give school leaders a clear view of the personal data use, integrations and risks within applications developed by their own staff. Start with privacy records and an Application Assessment, then add security testing and source code review.

Book a meeting Read client stories

Who It's For

Tailored assurance for every level of leadership

Whether you manage the network daily or report to the board, Security & Systems Essentials provides targeted coverage.

Technology Teams

Technology Directors

Gain senior hands for complex work packages, strategy sense-checks, and emergency cyber incident response from engineers who know your stack.

School Leadership

Heads of School

Gain total operational peace of mind. Protect your school’s reputation, avoid teaching downtime, and rely on a 360° Zero Trust safety net.

Boards & Directors

Boards & Governors

Receive clear, objective risk reporting mapped against international cyber standards to guide long-term technology and budget decisions.

The challenge

When a useful idea connects to school systems

AI coding tools and low-code platforms make it possible for staff to build applications around a school’s needs. They might create a dashboard using information from the management information system, automate a workflow or connect a teaching tool to Microsoft 365 or Google Workspace.

The school then needs to understand the application as part of its technology environment. That includes the information it can access, the changes it can make, its external dependencies and the arrangements for keeping it secure and supported.

9ine School Application Assurance brings these questions into a structured review. It is suitable for applications still being designed and for software already in use.

Findings your school can act on

Your school receives a record of what has been assessed, the evidence available, the risks identified and the actions required. A briefing brings together the relevant technology, privacy, safeguarding and leadership colleagues to consider the findings and record the school’s decision.

Where the agreed 9ine platform licences are in place, records and actions can be managed through the relevant platform workflows. Other engagements receive exportable records and an action register. Platform access and any additional configuration are confirmed in the proposal.

Why work with 9ine

9ine combines privacy, cyber security, technology and AI governance expertise with experience of school operations. Our independent review helps the people building an application work with the colleagues responsible for its data, safeguarding and ongoing use. The Diamond Formation provides the structure for that shared oversight.

2015686.fs1.hubspotusercontent-na1.nethubfs2015686Copy of Website blog images template (15)-1

What's included

What the service provides

Record of Processing Activities (ROPA)

We create or update the relevant Record of Processing Activities for the application.

Data Protection Impact Assessment (DPIA)

We prepare a Data Protection Impact Assessment covering the application’s use of personal data.

Application Assessment

This examines the application your school has built, including its purpose, safeguarding implications, access controls, external providers and support arrangements.

Development as well as deployment

The assessment considers personal data shared through prompts, test files, repositories or development environments, alongside the data used by the finished application.

Service tiers

Three tiers, scoped around your application

Governance Review

Discovery, data flow mapping, ROPA, DPIA, Application Assessment, prioritised actions and a leadership briefing.

Security Testing

Everything in Tier 1, plus OWASP Top 10 aligned testing of the running application and agreed API integrations.

Code Review

Everything in Tier 2, plus a review of the agreed source code, dependencies and relevant configuration.

Each tier includes a defined review of actions or targeted retest as applicable, within an agreed window. The scope is set around your application, data, user roles and integrations. Fees are quoted after scoping.

Our Experts

Backed by specialized consulting teams

You aren't just hiring one consultant; you get the combined knowledge of our dedicated practice areas.

FAQs

Common questions

Does the application need to use AI when it is running?

No. The service covers software developed using AI even if the finished application does not use an AI model. If AI remains active, we assess the associated data flows and governance arrangements. Specialist testing of model behaviour is agreed separately.

Does an internal application still need supplier review?

Yes, where external providers form part of the application’s data flow or development process. Coding platforms, hosting services, AI providers and integration services may still process information. The agreed assessment examines these dependencies as well as the school’s own controls.

Does the service certify our application?

The service provides findings and recommendations for the agreed scope, release and environment. It does not certify an application or guarantee security or compliance. The school retains responsibility for its decision, remediation and continued operation.

What's inside

Built from existing 9ine services

DPO Essentials & Privacy Consultancy

Expert privacy support behind the ROPA, DPIA and Application Assessment.

Explore DPO Essentials

Penetration Testing

OWASP web application testing behind Tier 2 and Tier 3.

Explore Penetration Testing

9ine Governance

Where findings and actions can be managed when platform licences are in place.

Explore Governance

Get in touch

Discuss an application your school is building

Tell us what it does, which school systems it connects to and whether it is already in use. We will help you define the appropriate assessment and testing scope. Please do not submit personal data, credentials or source code through the enquiry form.