Certification is the second, more concrete checkpoint. ISO 27001 is the recognised international standard for information security management, and a vendor holding current certification has had its security controls independently audited against that standard rather than simply asserting they are secure. For any part of a system handling payment data, such as fee billing or canteen top-ups, PCI-DSS Level 1 compliance is the equivalent standard specifically for payment card handling, and it is worth asking whether that certification covers the billing module directly rather than being described only at the level of the parent company.

More information is available at Compass Education UK Billing Management.

Find out more at Chronicle.

Data governance is the first. Publicly funded and diocesan schools are accountable for how records are held, shared and retained. Ask where data is hosted, which certifications the provider holds and how access is restricted by role. A system with clear, role-based permissions and a full audit trail makes it far easier to show that records are handled properly when a governor, auditor or authority asks.

Community and admissions rules deserve attention too. Faith schools frequently apply admissions criteria tied to the parish or the diocese, so the system should record the fields those criteria depend on and support the oversubscription process cleanly. If a platform cannot hold the data your admissions policy needs, the office ends up keeping a spreadsheet on the side, which defeats the purpose of a single system.

Certification is the third area worth confirming directly rather than assuming. Ask for current, dated evidence of information security certification such as ISO 27001, and, where the system handles payment data through billing or canteen accounts, confirmation of PCI-DSS compliance at the relevant level. Compass Education, like every other vendor on a shortlist, should be asked to produce this evidence directly rather than a school assuming it from marketing material or an incumbent relationship.