Every request encrypted in transit
Data and backups on ISO 27001 hosting
Character passwords, configurable to 12+
Of sign-ins and admin changes audited
Every control below is live in the product today. Where something is configurable, your deployment gets to choose the numbers.
Minimum length, complexity (four of five character classes), reuse history, minimum and maximum password age and an account lockout threshold are all set per deployment. Passwords are hashed with Argon2id.
Sign in with Apple or Google brings the provider's MFA into Tutorio. Password sign-in is guarded by lockout after repeated failures, and staff access to our infrastructure always requires MFA.
Students, tutors, organisation managers, staff and administrators each see only what their role allows - read-only, amend or full administration - enforced on every route and API call.
Sign-ins, sign-outs, failed and locked attempts, password changes and admin edits are recorded with the timestamp, user, IP address and the data before and after. Export as CSV or JSON, filtered by date, user or event.
TLS on every connection, encrypted volumes for the database and file storage, and encrypted backups. Secrets live in a managed vault, never in code.
Every sign-in screen warns that unauthorised access is an offence under the Computer Misuse Act 1990, that activity is monitored, and reminds authorised users of their acceptable-use obligations.
Mapped to the data-protection questions that councils and schools typically ask suppliers, with our answer to each.
Tutorio Ltd is the supplier and operator of the platform; the customer contract and data processing agreement cover the software directly.
All seven settings are configurable per deployment. Current defaults: 8+ characters, 3 of 5 character classes, last 5 passwords remembered, lockout after 10 failed attempts for 15 minutes. Password age limits are enabled on request.
Via Sign in with Apple and Sign in with Google, which enforce the provider's MFA. Staff access to production infrastructure is MFA-protected.
In-product onboarding, help articles and tutor guides are provided, plus a downloadable security pack for administrators and procurement teams.
Student, tutor, organisation manager, staff and administrator roles, enforced server-side on every page and API route.
Recorded for every sign-in, sign-out, failed or locked attempt, password change and administrative account change, and exportable as CSV or JSON.
Not yet a routine annual exercise. Can be commissioned as part of a contract, with findings and remediation shared with the customer.
Shown on every sign-in screen.
Yes - the database, file storage and every backup are held in UK data centres run by ISO 27001-certified providers. Nothing is stored outside the United Kingdom.
TLS in transit; encrypted storage and encrypted backups at rest.
Yes - for course drafting, marking against a mark scheme and the Rio study buddy. Tutors review all output; no automated decision has a legal or similarly significant effect on a learner. See the AI section below.
Our cloud providers hold ISO/IEC 27001 certification from accredited bodies.
Our providers publish alignment with the NCSC Cloud Security Principles and hold ISO/IEC 27017.
Automated encrypted backups and infrastructure-as-code rebuilds are in place; the written recovery runbook with tested restore times is being finalised.
The database, every uploaded file and every backup live in UK data centres run by ISO 27001-certified providers. Nothing is stored overseas.
Tutorio processes learner data as a processor on your behalf under UK GDPR and the Data Protection Act 2018. We collect the minimum needed to teach, and we never sell it.
Encrypted database volumes, encrypted object storage and encrypted backups.
TLS on every connection between browsers, apps, services and providers.
Argon2id password hashing, one-time reset tokens, sessions revocable everywhere in one click.
UK data centres run by ISO 27001 and ISO 27017 certified providers aligned with the NCSC Cloud Security Principles.
Automated, encrypted, kept in the UK and retained on a rolling schedule; restores rehearsed as part of the recovery runbook.
Production access limited to named engineers with MFA; every admin action is logged.
Yes, Tutorio uses AI. Here's exactly where, why, and what it never does.
Drafting courses and practice questions from a topic or a tutor's own materials, marking written answers against a mark scheme, and Rio - the in-lesson study buddy students can ask questions.
Tutors review and can edit everything the AI produces. No automated decision has a legal or similarly significant effect on a learner - grades, placements and reports remain the tutor's call.
Learner data is sent to AI providers only for the request in hand, under data processing terms, and is not used to train their models. AI features can be disabled for a deployment on request.
In the United Kingdom. The database, file storage and every backup are held in UK data centres run by ISO 27001-certified cloud providers, encrypted at rest. Nothing is stored outside the UK; the downloadable security pack lists every sub-processor and its location.
Yes. Administrators can export the audit trail as CSV or JSON, filtered by date range, user and event type. Each entry records the time, the user, their IP address, the action, whether it succeeded and the data before and after a change.
Sign in with Apple and Sign in with Google carry the provider's multi-factor authentication into Tutorio, and all staff access to Tutorio's infrastructure is protected by MFA. Password sign-in is protected by a configurable lockout policy.
AI drafts course content, marks written answers against a mark scheme and powers Rio, the in-lesson study buddy. Tutors review and stay in control of everything it produces; no decision with a legal or similarly significant effect on a learner is automated.
Not yet as a routine annual exercise. An independent penetration test can be commissioned as part of a contract, and we share the findings and remediation with the customer.
Policies, sub-processor list, data processing agreement, hosting details and a completed questionnaire - ready to drop into your due diligence.