ReferralMS is built with safeguarding at its core — not just for students, but for your data too. Here's exactly how we protect it.
Enterprise DB
NHS-grade database
TLS/SSL
Encrypted connections
bcrypt-12
Password hashing
RBAC
Role-based access
Rate Limited
Brute-force protection
Lockout
Account protection
HSTS
Security headers
UK GDPR
Compliant exports
PostgreSQL — the same database technology trusted by the NHS, GOV.UK, and major financial institutions
All connections encrypted with TLS/SSL — data is never transmitted in plain text
Managed hosting with automatic failover, ensuring high availability
Regular automated backups with point-in-time recovery capability
Multi-tenant architecture — every record is tagged with a unique organisation identifier
Schools can only see their own students. Providers can only see their own placements.
Data isolation is enforced at the database query level, not just the user interface
No cross-contamination between organisations — ever
One school or provider cannot access, view, or modify another organisation's data
Passwords are hashed using bcrypt with 12 salt rounds — we never store plain text passwords
Enforced password policy: minimum 10 characters, mixed case, numbers, and special characters
Real-time password strength indicator guides users towards strong passwords during signup
Common password detection — prevents weak, easily guessable passwords
Google SSO available as a secure single sign-on alternative
Role-based access control (RBAC) — Commissioners, Providers, and Admins see different data
Granular staff permissions — 15+ individual permission flags for fine-grained access
Session management with secure, HTTP-only cookies
Account lockout — automatically locks accounts after 5 failed login attempts for 15 minutes
IP-based rate limiting — login, signup, and API endpoints are protected against brute-force attacks
Security headers on every response: HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy
Centralised authentication middleware — every request is verified before reaching any data
DBS expiry monitoring — automatic alerts when staff DBS checks are expiring or overdue
Every significant action is logged: who did it, what they did, and when
Login activity tracking — every sign-in attempt (success and failure) is recorded with IP and timestamp
Referral creation, attendance marking, timetable changes, concern logging — all audited
Audit logs are tamper-proof and available for Ofsted inspections
Timetable changes create timestamped evidence trails with "notice served" records
Supports KCSIE 2025 requirements for accountability and transparency
Full Subject Access Request (SAR) export — download all data held about a student in one click
Platform administrators cannot see student data — data access is strictly limited to authorised roles
Structured data exports (JSON) for responding to data portability requests
Every data export is audit-logged for accountability
Compliant with UK GDPR and Data Protection Act 2018 requirements
Built from the ground up against the Ofsted AP inspection framework
DfE attendance codes recorded per session for census compliance
Risk assessments, QA visit tracking, and concern logging built in
Parent/carer portal uses secure, time-limited token-based access — no passwords needed
Safeguarding contacts accessible in seconds via one-tap quick profiles
Automatic database snapshots taken regularly
Point-in-time recovery available for disaster recovery scenarios
Option to upgrade to a dedicated production database for full isolation
Data export capabilities (CSV, PDF) so you always have a copy of your data
As the platform grows, infrastructure scales automatically — no downtime, no data loss
Every organisation gets their own secure space within the platform. Here's a simplified view:
✓ Sees only their referrals
✓ Sees only their students
✗ Cannot see School B's data
✗ Cannot see Provider data
✓ Sees students referred to them
✓ Records attendance for their placements
✗ Cannot see another provider's students
✗ Cannot see school-internal data
✓ Sees only their referrals
✓ Sees only their students
✗ Cannot see School A's data
✗ Cannot see Provider data
Absolutely not. Every database query is filtered by your organisation's unique ID. Even if someone tried to manipulate the URL, the API would reject the request because the data doesn't belong to their organisation.
Critical deletions require confirmation dialogs. Many operations use soft-deletes (deactivation rather than permanent removal). Audit logs record what was changed, and database backups provide a safety net for recovery.
Your data is stored on secure, managed cloud infrastructure. We take data residency seriously and comply with UK GDPR requirements for data protection.
No. The database is independently hosted and backed up. Even in the unlikely event of application downtime, your data remains safe and intact. Automatic backups mean data can be restored to any recent point in time.
No. ReferralMS uses granular staff permissions — each staff member can be given specific access rights (e.g., attendance only, safeguarding only, finance only). The system enforces these permissions at both the UI and API level.
Users can reset their own password via the "Forgot Password" link on the login page. The new password must meet our full security policy (10+ characters, mixed case, numbers, and special characters). Additionally, the platform administrator can reset any user's password directly from the admin panel.
ReferralMS has multiple layers of protection. IP-based rate limiting restricts login attempts per minute. After 5 consecutive failed attempts, the account is automatically locked for 15 minutes. All login attempts (successes and failures) are logged with IP addresses and timestamps for full accountability.
Authorised users can export all data held about a student with a single click — generating a structured file containing referral details, placements, attendance records, concerns, documents, and more. Every export is audit-logged so you have a record of who accessed what and when.