Security and assurance
Built for student data from the first line.
Information for data protection officers, IT security and procurement teams.
Read-only at source
Lyceum Data only reads from your systems. The connection uses read-only credentials and never writes back to your student record system.
UK data residency
Storage and processing are kept in a UK region.
Encryption
Data is encrypted in transit and at rest, with separate keys for each institution.
Separation between institutions
Each institution’s data is isolated at the database, storage and cache level. Dedicated hosting is available.
Access control
Sign-in through your own single sign-on, with role-based permissions for each user.
A full audit trail
Mapping changes, runs, suppressions and accepted risks are recorded with the person responsible and their reason. Records cannot be edited after the fact.
Repeatable results
Every run records the data extract, mapping, rules and software version it used, so any past result can be reproduced and explained.
Minimal data
Only the fields the HESA model needs are collected. Personal data is tagged so retention, subject access requests and erasure can be handled precisely.
UK GDPR
You stay in control of your data.
Your institution is the data controller. Lyceum Data acts as a processor under a data processing agreement. Logs hold identifiers and technical details, never full student records, and files are only available to authorised users.
Certifications and standards
Where we are today.
- SOC 2 Type IIAudit in progress
- ISO/IEC 27001Certification in progress
- Cyber Essentials PlusIn progress
- UK GDPRProcessor terms under a data processing agreement, UK data residency
Ask us for our current status and timeline.
Request our security pack
We’ll share our security overview, data processing agreement and certification timeline with your team.