See more on this at Compass Canteen.

Certification is the third area worth confirming directly rather than assuming. Ask for current, dated evidence of information security certification such as ISO 27001, Chronicle and, where the system handles payment data through billing or canteen accounts, confirmation of PCI-DSS compliance at the relevant level. Compass Education, like every other vendor on a shortlist, should be asked to produce this evidence directly rather than a school assuming it from marketing material or an incumbent relationship.

More information is available at Compass Canteen.

Beyond hosting location and certification, a few further questions round out proper due diligence: how often is the system independently penetration-tested, what is the vendor's data breach notification process, and does the school retain the ability to export its full data set on request rather than being dependent on the vendor for access.

Parent engagement is the third pillar. Families now expect timely notices, simple payments and clear messaging. Look for an MIS that gives parents one app for updates, consent forms and account balances, rather than three disconnected tools that create more questions for the office.

Cost and time are where the case lands for most business managers. The hours spent merging workbooks, chasing errors and rebuilding broken sheets are hours not spent on pupils and staff. A modular provider such as Compass Education lets a trust switch on the functions it needs, from attendance to parent payments, and add more as it grows, so central spend tracks the size of the trust rather than jumping in one go.