How we rate tools
Every tool gets a traffic-light rating worked out by fixed rules from the supplier’s own published documents. Here is exactly how it works, in plain English.
Not legal advice. You still need to do a DPIA (data protection impact assessment) and follow your school’s or trust’s data protection process. A green rating means fewer warning signs in the published terms, not that a tool is approved.
The key
GREEN
Lower risk: fine to use with normal checks
The supplier works for your school (a processor), doesn’t train its AI on what you type, keeps data in the UK/EU or states proper transfer safeguards, and offers a school data agreement (DPA).
AMBER
Use with caution
Some answers are missing or depend on settings. Check the reasons, ask the supplier, and talk to your data protection officer (DPO) first.
RED
Not recommended for school data
Something in the terms is a serious problem for school data: it trains on what you type by default, the supplier is a controller, it won’t sign a DPA, or (for pupils) it’s 18+.
GREY
Not enough information yet
We haven’t finished reading the supplier’s documents, or they leave too many key questions unanswered to rate.
Right now, for staff use: 13 green, 153 amber, 51 red and 61 grey, out of 278 tools. Each rating also has an icon (✓ ! ✕ ?) so it doesn’t rely on colour.
What we check
We read the supplier’s privacy notice, terms, data processing agreement and help pages, and answer six key questions:
- Who is in charge of the data? A processor only uses data as your school tells it. A controller makes its own decisions, so your school has less say.
- Does it learn from what you type? If prompts or uploads can be used to train the AI, anything about pupils or staff could end up in it.
- Where is the data kept? UK or EU is simplest. If data goes abroad, we look for the legal safeguards (standard contractual clauses, the UK IDTA or addendum, or an adequacy decision).
- Is there a school data agreement? A DPA is the contract that says how the supplier must look after your data.
- How long is what you type kept?
- How old do users have to be? This only affects the pupil rating.
| Criterion | In everyday words | ✓ Fine for green | ! Makes it amber | ✕ Makes it red |
|---|---|---|---|---|
| Processor or controller | Does the supplier only use data on your school’s instructions? | Processor | Not stated, or depends on use | Controller |
| Trains on what you type | Could your prompts and uploads be used to improve their AI? | No | Not stated, or depends on plan or settings | Yes, by default (even with a per-user opt-out) |
| Where data is stored | Does data stay in the UK/EU, or are there legal safeguards if it leaves? | UK/EU, or abroad with stated safeguards and a DPA | Not stated; abroad without safeguards; or safeguards but no DPA | n/a |
| School data agreement (DPA) | Is there a contract setting out how they look after your data? | DPA link, or they say they sign one | None found | They say they won’t sign one |
| How long inputs are kept | Do they say when they delete what you type? | Stated | Counts towards “key fields not stated” | n/a |
| Minimum age (pupil rating only) | Are pupils old enough to use it? | Suits pupils | 13–17, not stated, or 18+ but allowed via a school account | 18+ or “not for pupils” |
The order the rules apply
- Grey first. If our research is unfinished (“needs full read” or “listed only”), or the supplier doesn’t say whether it trains on inputs and 4 or more of the 6 key answers are missing, we don’t rate it.
- Then red. Any one red answer makes it red: trains on inputs by default; supplier is a controller; supplier won’t sign a DPA.
- Then amber. Any amber answer, or 3 or more key answers missing, makes it amber.
- Otherwise green. Green only when nothing above applies.
Every rating lists its reasons, and each reason links to the fact it comes from on the tool’s page.
Staff and pupil ratings
We rate staff use and pupil use separately, because pupils need extra care. The pupil rating starts from the staff rating, then:
- it turns red if the tool is 18+ or the supplier says it isn’t for pupils (amber instead if younger pupils may use it through a school account);
- it’s at least amber if the minimum age is 13–17 or not stated.
If both ratings match, we show one. If not, we show both, for example “Staff: Green, Pupils: Red”.
Consumer assistants made for the general public carry a “General-purpose, not designed for schools” label. It doesn’t change the rating.
Safer alternatives
For every amber or red tool we suggest up to three like-for-like swaps: tools with the same main use (for example AI writing detection, exam proctoring or homework answer apps are kept separate) and at least one sector in common, that rate better for the same audience: green first, then amber tools with fewer reasons. They are worked out from our published ratings by the same rules, never hand-picked. Each tool’s main use is set by hand in our category list. Alternatives are suggested from our published ratings; check they meet your needs. Where nothing rates better, we say so, list what to look for, and add the gap to our weekly research list.
Sources we use
Only the supplier’s own published documents: privacy notice, terms of service, data processing agreement, sub-processor list, trust or security centre, and help pages. We don’t use sales emails, private assurances or news reports. If we can’t find something, we show not stated, and we never guess. Each tool page lists its sources.
How often it’s re-checked
- An automated check runs every day at 07:00 UK time (06:00 UTC) and flags any wording change in a supplier’s documents for a person to re-read.
- Every entry is meant to be re-read in full at least monthly. Pages not checked for over 30 days show a “may be out of date” warning.
- Ratings are recalculated automatically whenever an entry changes. See Recently changed.
What we don’t assess
- Whether the tool is educationally good, accurate, or value for money.
- Security testing, accessibility, or content safety in practice.
- Your school’s own contract, settings or how you plan to use it.
- Whether it meets the DfE filtering and monitoring standards or your safeguarding policy.
This rating is a summary of published terms. It isn’t legal advice and isn’t a substitute for a DPIA. Always read the supplier’s current documents. Full technical rules: Methodology.