AI Safety & Compliance

AI Tools That Keep Pupil Data in the UK: 6 Picks and What UK-Hosted Does Not Cover

Six AI tools record UK hosting, but only three name a UK location on their own pages. Which ones, what UK-hosted leaves out, and four questions to put to any vendor.

A pink cut-paper island with a white dot at its center sits inside a thick black hand-drawn ring while a black arrow arriving from the upper right stops short of the ring, standing for pupil data kept inside a boundary and the checks that decide what crosses it.

In brief

Six AI tools in our directory record UK hosting and fit classroom jobs, but only Sendix, TeachScribe and DeepMark name a UK location on their own pages, checked November 9, 2026. DeepMark's policy still lists EU and US sub-processors. Ask each vendor where data is stored, where the model processes it, who else sees it, and whether pupil work trains models.

Worth noting

  • Of 15 directory listings that record UK hosting, only one, EnlightenAI, carries an independent 9ine security assessment (directory API, November 9, 2026, 138 listings).
  • Of the seven vendors whose pages we could read, three name a UK location: Sendix (Azure UK South and AWS London), TeachScribe and DeepMark.
  • DeepMark's homepage says data stays in the UK, but its privacy policy lists sub-processors in the EU and US under transfer safeguards, so UK-hosted describes where the app runs, not where every script travels.
  • The Department for Education's generative AI product safety standards, updated January 19, 2026, ask where data will be processed and what safeguards apply outside the UK or EU.
  • Under the UK-US data bridge a US recipient must be certified to the UK Extension and on the DPF List; if it is not, ask which other safeguard applies.

Six AI tools in our directory record UK data hosting and fit a real classroom job: Sendix for EHCP drafting, TeachScribe for early years observations, DeepMark for secondary marking, EnlightenAI for writing feedback, StaffDraft for school writing and Olex.AI for English marking. Only three of them, Sendix, TeachScribe and DeepMark, name a UK location on their own pages (checked November 9, 2026), and DeepMark's privacy policy still lists sub-processors in the EU and the US. Treat "UK-hosted" as the first question to put to a vendor, not the answer.

This is for teachers, SENCOs (special educational needs coordinators) and data protection leads in UK schools, where the usual word is "pupil data" and "marking" means grading. US readers can read it as student data and grading; the checks are the same. The Department for Education's generative AI product safety standards, last updated January 19, 2026, ask makers to say "where data will be processed, and whether there are appropriate safeguards in place if this is outside the UK or EU" (DfE). That sentence is the test this page applies.

How was this list built?

We started from the AI Educator Tools directory's public API on November 9, 2026, which returned 138 listings. A hosting location is recorded for 86 of them: 40 say United States, 17 European Union and 14 United Kingdom, with one more that splits UK or EU by customer location. Only one of those 15, EnlightenAI, carries an independent 9ine security assessment, out of 36 assessed listings in the directory (what the assessments cover). The hosting fields are vendor statements that we recorded, not audits.

For the six featured tools we then read the vendor's own pricing, privacy and terms pages. We left out EduTestPro, whose pages name no location and whose terms are marked as a draft, and Readling, whose pages returned no readable text to our fetcher. We chose the six for the jobs they do and for whether a school can check their claims, and each is linked to its directory page. We use "UK-hosted" only where the vendor's own text says it.

Which AI tools state a UK location on their own pages?

Three do. Read the third column as what the vendor's pages say, not what the directory records, because the directory records UK hosting for all six.

Tool Best use The vendor's own pages say Price / free tier (checked Nov 9, 2026)
Sendix EHCP drafting for SENCOs "Hosted and processed in the UK"; Azure UK South and AWS London School plan £750 a year, England, excluding VAT
TeachScribe Voice observations in early years "UK-Hosted Data"; notice says processing is "primarily" in the UK and EEA No public pricing; book a demo
DeepMark Secondary exam marking App on AWS London; policy also lists EU and US sub-processors 20 papers free; Department from £250 a term
EnlightenAI Writing feedback against your rubric No location named; servers "hosted by a third-party service provider" Free teacher plan mentioned in terms; no public pricing page found
StaffDraft Emails, report comments, references No location found 10 drafts a month free; £6 a month unlimited
Olex.AI English marking, Years 1 to 11 No location named No public prices; annual subscription

Sendix: best fit for SENCOs drafting EHCPs

Sendix is the best fit for a SENCO drafting an Education, Health and Care plan (EHCP, the legal document that sets out a child's support in England) because it is the only tool here that names where the data sits and where the AI model runs: the app, database and backups in Azure UK South, the model through Amazon Bedrock in AWS London (Sendix data protection). It is staff only: "Nothing goes to families from Sendix." The directory shows 5.00 from one review.

Watch out for: The terms say real pupil data goes in only after a countersigned data processing agreement, and until then you should use fictional documents. They also say "this is not a zero-retention service" and that an independent penetration test is booked for January 2027 (terms). Pupil identifiers are removed before the model sees the text, but the page admits "Other names can remain."

Pricing: School £750 a year for up to 15 plans, then £50 for each extra plan. Trust £50 a plan a year, minimum £3,000, capped at £9,500. Special school £3,500 a year for up to 120 plans. All excluding VAT, England figures, read on the pricing page on November 9, 2026. The directory lists pricing as "contact", but the vendor now shows prices.

Safety: Sendix says the school or trust is the data controller and Sendix the processor, with the agreement (version 1.2, dated October 15, 2026) signed in the app. Its terms say it will not use student data to train models outside the customer's documented instructions. Whether your trust will sign is your trust's decision. If you only need clearer wording and not a plan check, a tool your trust already approves does the job; our guide to AI tools for SENCOs compares the wider field.

TeachScribe: best fit for early years practitioners who dictate observations

TeachScribe is the best fit for a practitioner in an Early Years Foundation Stage setting (children aged 3 to 5) who wants to speak an observation into a lanyard microphone and not type it up after the children go home, and its homepage says "UK-Hosted Data". Its privacy notice, last updated March 22, 2026, says personal data is "primarily processed in the UK and EEA" and that anything outside the UK happens only through arrangements in a sub-processor list (privacy notice). No child accounts are described.

Watch out for: "Primarily" is not "only", and we did not read the sub-processor list. The notice lists audio among stored content but says nothing we could find about deleting audio after transcription. Backups can keep deleted data for up to 180 days.

Pricing: No public pricing; the homepage offers a demo. Treat the cost as unverified until you have a quote.

Safety: The notice names the school as controller and TeachScribe as processor, and says TeachScribe "does not use school-controlled personal data" including audio and transcripts "to train, fine-tune or improve AI models". It names no AI provider. If your need is planning and parent notes, not observation, AI tools for preschool teachers covers tools that never touch a child's record.

DeepMark: best fit for secondary departments marking scripts together

DeepMark is the best fit for a secondary department marking GCSE and A level scripts to a shared scheme, because it is teacher only ("Children may not create or operate DeepMark accounts") and its homepage says the app runs on AWS London. The directory shows 5.00 from one review.

Watch out for: The homepage says "Data stays in the UK", but the privacy policy's sub-processor table lists a Neon database in the EU, Google Gemini and Cloud Vision in the EU or US, and Anthropic in the US, protected by standard contractual clauses and the UK International Data Transfer Addendum (privacy policy, updated May 1, 2026). So "UK-hosted" describes where the app runs, not where every script travels. No standard data processing agreement is published; the homepage says a data protection impact assessment is "available on request".

Pricing: Free for 20 papers with no expiry. Department from £250 a term, or £3.50 per pupil per course per year. Individual £5 for 15 papers (pricing, November 9, 2026).

Safety: Teachers must be 18 or over. The policy says "We do not use student work to train AI models" and that the school remains controller. Choose Olex.AI or EnlightenAI instead if your marking is essays against a rubric and not exam scripts moderated by a team.

EnlightenAI: best fit for writing feedback with an independent assessment

EnlightenAI is the best fit for a department that wants writing feedback calibrated to its own rubric and values an independent check, since it is the only one of the six whose directory listing carries a 9ine security assessment. Teachers set the rubric and calibrate on sample pieces; students get feedback through a link the teacher shares, and "students may not directly sign up" (privacy policy, updated October 23, 2026).

Watch out for: The directory records UK hosting, but we found no UK or EU location on the vendor's pages. The policy says only that servers are "hosted by a third-party service provider", the operator is Teaching Lab Ventures, Inc. in Washington, DC, and the terms are governed by California law. It says it uses "multiple AI vendors" and we did not find where they process data. Until the vendor shows a UK location in writing, treat the directory field as unconfirmed.

Pricing: The terms mention "a generous free plan for teachers" but we found no public pricing page. Unverified.

Safety: The data processing agreement says EnlightenAI is a processor, covers the "United Kingdom Data Protection Act (2018)" among its laws, and the policy says "No AI provider we use has the right to train models on any data processed on EnlightenAI's behalf." Deletion follows within 30 days of a request. Pupils under 18 may use it "with the involvement and consent of a parent, legal guardian, or at the direction of your school."

StaffDraft: best fit for school staff who write the same messages every week

StaffDraft is the best fit for a teacher or office manager who turns rough notes into parent emails, report comments and reference letters, because its homepage says "Drafts are not retained after processing" and its prices are public.

Watch out for: When we fetched its privacy and terms pages they returned the homepage text, so we found no hosting location, minimum age or statement on model training. The directory records UK hosting and an 18+ minimum; neither is confirmed by the vendor's pages. Keep pupil names out of any draft whichever tool you use. The DfE says "any data entered should not contain information that could allow an individual to be identified" (DfE).

Pricing: Free for 10 drafts a month. Individual £6 a month, unlimited. Whole-organization £5 per user a month, minimum 20 users. Credit packs from £2.99 for 20 drafts (staffdraft.ai, November 9, 2026). A footnote says prices are shown in USD as approximate GBP equivalents, so check the currency at checkout.

Safety: The plan table says "Formal DPA available"; we could not read it or see which role StaffDraft takes. Choose Sendix or DeepMark instead when the work involves pupil records, since they say where the data goes.

Olex.AI: best fit for English departments that will ask for a location in writing

Olex.AI is the best fit for an English department marking handwritten or typed essays from Year 1 to Year 11, if it will get a named location in writing before signing. Olex describes AI marking and feedback on handwritten or typed essays with teachers reviewing the output, and its pupils use a student portal (features). The directory shows 4.00 from two reviews.

Watch out for: The vendor's pages name no hosting location. The privacy policy names School Reviewer Limited, trading as Olex.AI, as the controller, which is worth clarifying for a school-facing product, and it links a DPIA support document that we did not read (privacy policy).

Pricing: "There are no per-script fees. Unlimited marking is included in your annual subscription." No prices are shown and the calls to action are demos, so the cost is a quote (checked November 9, 2026).

Safety: The homepage FAQ says "Student work is never used outside of Olex to train any global AI models." We found no minimum age and no AI provider named. Choose DeepMark if you need a UK location on the page today.

What about ChatGPT, Gemini, Copilot and Oak's Aila?

None of these is a UK-hosting answer for every school, and the picture is moving.

  • ChatGPT: OpenAI lists the UK for data residency "for eligible API customers and for new ChatGPT Enterprise and Edu workspaces", at rest only, in an update dated October 27, 2025 (OpenAI). We could not confirm anything for free, Plus or teacher plans.
  • Google Gemini: Google's Workspace data regions page offers "the United States, Europe, or No preference", and we found no UK option (Google). Its privacy hub, updated October 6, 2026, says Workspace "does not use customer data for training models without customer's prior permission or instruction" (Google).
  • Microsoft Copilot: An April 3, 2026 editor's note says UK in-country processing of Microsoft 365 Copilot interactions "is expected to become available" by the end of 2026 (Microsoft). It does not say whether education tenants are covered.
  • Oak National Academy's Aila: Free, built for teachers, and its FAQ says "you must not input personally identifiable information into Aila" (Oak). Hosting is not the question for a tool you never give pupil data.

Which four questions settle a UK-hosted claim?

Put these to any vendor, in this order, and write down the answers.

  1. Stored where, and processed where? Storage is the database and backups. Processing is the AI model reading your text. Sendix names both; DeepMark's policy separates them.
  2. Who else sees it? Ask for the sub-processor list and each one's country. A US company is not an automatic problem: the UK-US data bridge, in force since October 12, 2023, lets UK organizations send personal data to US recipients certified to the UK Extension "without the need for further safeguards", but the recipient "must be certified to the UK Extension and appear on the DPF (Data Privacy Framework) List" (gov.uk factsheet). Otherwise ask what safeguard replaces it.
  3. Does pupil work train a model, and who is the controller? The DfE standards expect products to "not collect, store, share or use personal data for any commercial purposes, including further model training and fine-tuning" without a confirmed lawful basis. Ask for the vendor's data protection impact assessment, and write your own.
  4. Do you need pupil accounts at all? Teacher-only tools shrink the question. DeepMark, Sendix and StaffDraft are staff tools; EnlightenAI and Olex.AI reach pupils.

This is not legal advice. Your data protection officer decides, and the school stays responsible for what it enters.

Worked example: 120 Year 10 essays marked by four teachers

A Year 10 English department (ages 14 to 15, about 9th grade) has 120 essays on one question and four markers who disagree about a Grade 5. This is a plan, not a record of a trial.

  1. Pick a teacher-only tool, since no pupil needs an account to be marked: DeepMark.
  2. Ask for the data processing agreement and the data protection impact assessment. DeepMark's homepage says the assessment is "available on request".
  3. Read the sub-processor table and write the EU and US processors into your own assessment, with the transfer safeguard each one names.
  4. Replace names with candidate numbers before anything is uploaded.
  5. Use the free 20 papers on scripts the team has already marked, and compare the tool's marks with theirs.
  6. Have the head of department moderate every disagreement, then decide whether to buy.

What the directory and the vendors' pages show together

Of the seven vendors whose pages we could read (DeepMark, EnlightenAI, StaffDraft, TeachScribe, Sendix, Olex.AI and EduTestPro), three state a UK location: Sendix, TeachScribe and DeepMark. The other eight UK-hosted listings, AI Maths Tutor Skye, AIR, Baobab, Dr Connor, Edu Intelligence, Excelas Learn, Snaap.app and Readling, we did not check against vendor pages. A gap between a listing and a vendor's page means one of them needs updating, not that anyone is hiding anything. For the wider count of blank privacy fields, see our October analysis; for the approval process around a shortlist, AI tools a school can approve and safe AI tools for schools walk through it.

The bottom line

Ask for the location in writing before any pupil data goes in. Sendix, TeachScribe and DeepMark have already put one on the page; EnlightenAI, StaffDraft and Olex.AI have not, as far as we could find. Browse the School Administration and Safety category or the full directory for more, and check each vendor's current terms yourself, because pricing and policies change.

Dan Fitzpatrick is the founder of AI Educator Tools. Last checked November 9, 2026.

Frequently Asked Questions

Which AI tools keep pupil data in the UK?

Of the tools we checked, Sendix, TeachScribe and DeepMark name a UK location on their own pages (November 9, 2026). Sendix names Azure UK South and AWS London; TeachScribe says processing is primarily in the UK and EEA; DeepMark's app runs on AWS London but its policy lists EU and US sub-processors.

Does UK-hosted mean a tool is safe to use with pupil data?

No, UK-hosted says where a database sits, not whether the tool is safe for your school. Check where the AI model processes text, who the sub-processors are, whether pupil work trains models, and whether your school has a signed data processing agreement and its own impact assessment.

Can UK schools use ChatGPT, Gemini or Copilot with pupil data?

That is a decision for your school's data protection officer, and the DfE says any data entered should not contain information that could allow an individual to be identified. OpenAI lists UK data residency for new ChatGPT Enterprise and Edu workspaces, and Microsoft expects UK in-country Copilot processing by the end of 2026.

What is the UK-US data bridge and does it cover every US AI vendor?

It lets UK organizations send personal data to US recipients certified to the UK Extension of the EU-US Data Privacy Framework without further safeguards, but only for recipients on the DPF List. A US sub-processor that is not certified needs another safeguard, such as a UK International Data Transfer Addendum.

Do AI tools for schools need a data protection impact assessment?

The DfE's product safety standards expect makers to conduct a data protection impact assessment during development and across the tool's life, and they describe Article 35 as requiring one for high-risk processing. Ask the vendor for theirs, and ask your data protection officer whether you need your own.

Are there free AI tools for UK teachers that never touch pupil data?

Yes, Oak National Academy's Aila is free and built for teachers, and its FAQ says you must not input personally identifiable information into it. That makes it a lesson-planning tool, not a place for pupil records, and its hosting matters less for that reason.

D
Dan Fitzpatrick

Delivered training to 150K+ educators | Founder of The AI Educator and AI Educator Tools | Forbes Contributor | International Keynote Speaker | 4 x #1 Bestselling Author

Cite this article

Dan Fitzpatrick. (November 9, 2026). AI Tools That Keep Pupil Data in the UK: 6 Picks and What UK-Hosted Does Not Cover. AI Educator Blog.

https://blog.aieducator.tools/posts/ai-tools-that-keep-pupil-data-in-the-uk
Links and sources in this article (18)

Collected from links in the article text. Inclusion is not independent verification of a provider’s claims.