How SENScribe Protects Student Data
Last updated: 1 July 2026
A plain-English technical guide to our client-side encryption and PII redaction architecture. Share this with your Principal, DPO, or IT administrator.
Executive Summary (30 seconds)
The Problem: Teachers need AI help with paperwork, but sending student names to cloud services creates GDPR risk.
Our Solution: Two layers of protection. Before AI processing, SENScribe checks and redacts personal details in the teacher's browser. For data storage, all Student Support Files are encrypted on the teacher's device before being stored on our servers, which hold ciphertext and wrapped key material only.
The Result: Teachers get AI-powered drafts and multi-device access. Schools get strong data protection. During normal operation SENScribe has no technical means to decrypt stored data - decryption depends on teacher-held credentials - and privacy checks are built into every AI request.
How Client-Side Encryption and PII Redaction Work
You Type in Your Browser
You enter your observations including student names. This text exists only in your browser's memory.
Names Are Detected & Replaced
Our JavaScript code runs locally in your browser, detecting names and replacing them with placeholders like [PERSON_1].
Diagnoses Are Generalised
Specific conditions like 'ADHD' or 'dyslexia' are replaced with functional categories like 'attention regulation needs'.
Privacy-Checked Text Is Sent
SENScribe checks and redacts the complete request in the browser immediately before AI processing.
AI Generates the Draft
Microsoft Azure OpenAI (within the EU data zone) generates professional language based on the redacted and generalised context.
Names Are Restored Locally
The response returns to your browser where our code swaps [PERSON_1] back to the real name. Student Support Files are encrypted and synced to our servers for multi-device access.
What Data Goes Where
| Data Type | Your Device | SENScribe Servers | Microsoft Azure | Stored? |
|---|---|---|---|---|
| Student Names | ✅ Yes | 🔒 Encrypted only | ⚠️ Not intended; automated redaction* | 🔒 Encrypted on your device (no technical means to decrypt during normal operation) |
| Specific Diagnoses (ADHD, ASD, etc.) | ✅ Yes | 🔒 Encrypted only | ⚠️ Generalised before sending* | 🔒 Encrypted on your device (no technical means to decrypt during normal operation) |
| School Name / Class | ✅ Yes | 🔒 Encrypted only | ⚠️ Not requested; may appear in free text* | 🔒 Encrypted on your device (no technical means to decrypt during normal operation) |
| Generalised Needs (e.g., 'attention regulation needs') | ✅ Yes | ✅ Streamed only | ✅ Processed | Azure: only if selected for human abuse review |
| Redacted and Generalised Observations | ✅ Yes | ✅ Streamed only | ✅ Processed | Azure: only if selected for human abuse review |
| Your Email (for login) | ✅ Yes | ✅ Yes | ❌ No | ✅ Eligible personal accounts: deleted after 12 months of inactivity |
* Automated redaction reduces risk but cannot guarantee recognition of every identifier in free text. Do not include school names or class identifiers in observations, and use only the minimum necessary information.
Diagnosis Generalisation: Why "ADHD" Becomes "Attention Regulation Needs"
Even with names removed, specific diagnoses could theoretically help identify a student in a small school. We address this with an additional layer: condition generalisation.
Before (What You Type)
"The student has ADHD and dyspraxia. Recently diagnosed with autism..."
After (What We See)
"[PERSON_1] has attention regulation needs and motor coordination difficulties. Recently identified with social communication needs..."
This is based on HIPAA-endorsed generalisation techniques for de-identification. The AI can still suggest relevant interventions because it understands the functional needs, but re-identification risk is dramatically reduced.
GDPR Compliance Summary
Article 5(1)(c) - Data Minimisation
Safeguard appliedAI requests are redacted and generalised immediately before sending. Stored data is encrypted on the teacher's device; during normal operation we have no technical means to decrypt it (decryption depends on teacher-held credentials).
Article 9 - Special Category Data
Safeguards appliedStudent data is encrypted on the teacher's device (AES-256-GCM); servers hold ciphertext and wrapped key material only, with no technical means to decrypt during normal operation. AI requests are redacted and generalised before processing. Automated redaction reduces risk but cannot guarantee recognition of every identifier in free text.
Article 17 - Right to Erasure
SupportedEligible personal accounts and their personal data are deleted after 12 months of inactivity. Organisation-controlled records follow the school's offboarding or deletion instructions.
Article 44 - International Transfers
Safeguards documentedThe customer database is in an Azure EU/EEA region (West Europe) and AI processing uses the EU data zone. The privacy notice documents transactional email providers, regions, and transfer safeguards.
For Your Data Protection Officer
Do we need a DPIA? SENScribe has conducted a Data Protection Impact Assessment for our encrypted sync service. We recommend schools document SENScribe in their Register of Processing Activities. Read our DPIA.
Is SENScribe a Data Processor? Yes. We store encrypted Student Support Files on behalf of teachers. However, during normal operation we have no technical means to decrypt this data (decryption depends on teacher-held credentials) - only the teacher holds the decryption key. Read our Data Processing Agreement.
What about the AI provider?Microsoft Azure OpenAI Service operates under Microsoft's standard Data Processing Addendum, which includes GDPR SCCs. Microsoft states that prompts are not used to train foundation models without customer permission or instruction; SENScribe has given neither. Prompts flagged for potential abuse may enter additional review, with human review by authorised EEA-based employees for European deployments. SENScribe applies browser-side redaction and generalisation before transmission; the full limitations are documented in our Privacy Policy.
Technical Implementation Details
- Client-Side Redaction: Our proprietary privacy engine runs entirely in your browser, using multiple detection layers including natural language processing and machine learning to detect and replace likely names and common direct identifiers such as phone numbers, emails, PPS numbers, dates, eircodes, addresses, and professional registration numbers.
- Condition Generalisation: Specific diagnoses are automatically mapped to functional categories aligned with Department guidance, ensuring medical terminology is replaced with needs-based descriptions before transmission.
- Client-Side Encryption: Student Support Files are encrypted with AES-256-GCM on your device using a key derived from your data password. Encrypted data is synced to our Azure-hosted servers in the EU for multi-device access. Servers hold ciphertext and wrapped keys only; during normal operation we have no technical means to decrypt stored files - decryption depends on your data password or recovery key.
- Transport Security: All communication uses HTTPS/TLS. API endpoints are protected with rate limiting and authentication.
- Data Residency: Azure OpenAI processing occurs within the European Union data zone. Account data and encrypted sync data are hosted in Azure Cosmos DB in an Azure EU/EEA region.
Ready to Try SENScribe?
Start a 14-day free trial to evaluate the tool. No credit card required. Share this whitepaper with your Principal or DPO.