The paperwork, in one place.
Including the parts we have not finished.
A data protection officer evaluating an AI tool needs a specific set of documents. This page lists every one of them, what it contains, and whether it exists yet.
7 documents listed
4 published
3 in preparation
0 hidden
Section 01
Published and readable today
These are live on this site. Read them before you ask us anything — they are written to be checked, not skimmed.
- 01DfE product safety standards mappingPublished
Teacher Manager's marking component assessed against all thirteen DfE generative AI product safety standards, published with the gaps intact.
Asked for by: Procurement, DPO, headteacher
- Which standards apply and which do not, and why
- A status for every applicable standard
- The named gap behind every partial status
Read the document →
- 02AI transparency statementPublished
What the model is, where your data stays, what the model sees, and what it will not do.
Asked for by: Teachers, DPO, governors
- Where your data stays, and what never leaves the building
- How Aevum trains, stated precisely
- What the tool will not do
- Disclosure of AI-generated imagery, and where a real photograph is always used
Read the document →
- 03Sub-processor listPublished
Who else, if anyone, processes data on Aevum's behalf — kept deliberately short by architecture.
Asked for by: DPO, procurement
- Sub-processors for the Aevum website, which is a separate question from the product
- Sub-processors for Teacher Manager, which the design is built to keep at zero
- A change-notification route so schools hear before anything moves
Read the document →
- 04Data Protection Impact AssessmentPublished
The risk assessment UK GDPR requires for processing likely to be high risk, including children's data.
Asked for by: DPO
- What personal data is processed, and where it stays
- How little the model ever sees, and why
- The risks we judge most serious, with the mitigation against each
- The gap we are least comfortable with, and what is still outstanding
Read the document →
Section 02
Still in preparation
Where a document does not exist yet we say so, and we say what is blocking it. We would rather be checkable than impressive.
- 05Data Processing AgreementIn preparation
The UK GDPR Article 28 agreement a school signs as controller, with Aevum as processor.
Asked for by: DPO, procurement, legal
- The controller and processor split, written down
- Article 28 obligations, including sub-processor consent and audit rights
- Retention and deletion, including of anything the local model has learned
- A form a school can counter-sign without amendment
What has to happen first
This is a contract, so a solicitor drafts and reviews it before it appears here. You will get an agreement that has been checked, not a template we typed out ourselves.
- 06Security overviewIn preparation
How Aevum secures what it holds, and how little that is.
Asked for by: DPO, IT lead, MAT technical lead
- The threat model for data that stays in the building, and how it differs from a cloud one
- Access control, update integrity and the model artefact
- Vulnerability management and testing cadence
- Compatibility with the Cyber Security Standards for Schools and Colleges
What has to happen first
We publish this once the red-team report and an independent review are in hand. Security is the applicable DfE standard we are furthest from, and the mapping says so plainly rather than quietly.
- 07Incident response and reportingIn preparation
How a school reports a concern, and what Aevum does next.
Asked for by: DPO, safeguarding lead
- How to report a safety or data concern, and who receives it
- Notification to the controller, and to the ICO where required
- How a fix is tracked to closure and communicated
- Post-incident review shared with affected schools
What has to happen first
We publish this alongside the written procedure and the complaints mechanism the DfE governance standard requires, both of which are next on the list.
Requesting something not listed here
If your procurement process needs a document that is not on this list, or an early sight of one still in preparation, write to hello@aevumfoundry.ai and say which and why. We will either send it, or tell you honestly when it will exist.