CE Readiness Scanner privacy statement
EdTech Solutions Ltd provides this service to schools, trusts and other organisations. RoarTech Ltd owns and licenses the software to EdTech Solutions Ltd and publishes its Microsoft Entra application. This statement explains the scanner's use of Microsoft 365 tenant data. It supplements the privacy and data processing terms in the customer's agreement with EdTech Solutions Ltd.
Who controls the data
The customer determines why its Microsoft 365 tenant data is used and remains the controller of personal data in that tenant. EdTech Solutions Ltd processes that data to deliver the service under the customer's instructions and agreement. Where RoarTech Ltd needs access to support the software, that access is controlled under EdTech's written arrangements. EdTech is responsible for its own business contact and service administration data.
Data the scanner can access
When a customer administrator grants the application permissions and enables the relevant checks, the scanner may read tenant and domain details; users and account status; directory roles; authentication policies and registration; sign-in and audit logs; risky identity signals; application registrations; Secure Score; Defender incidents and alerts; and Intune device and policy information. This may include names, work email addresses, device identifiers and security event details. The scanner's configured Microsoft Graph permissions are tenant-wide. It does not require mailbox content or passwords for these checks.
The service reads only the information needed for enabled checks. It records selected findings and evidence with source and collection time. Microsoft Graph access tokens and raw responses are not presented to users of the browser portal.
Why and how the data is used
EdTech uses the data to assess Microsoft 365 security configuration, identify issues for review, support Cyber Essentials readiness and Cyber Essentials Plus preparation, and show authorised customer staff their findings. Results are advisory. The scanner does not certify an organisation, make decisions about an individual, or replace an incident response service.
Access, hosting and sharing
Only authorised customer users and EdTech staff may see findings appropriate to their roles. RoarTech technical staff may receive limited access where needed to support the software under EdTech's controls. The Security Portal is hosted in the UK and delivered through Cloudflare; Microsoft provides the source data through Microsoft Graph. EdTech does not sell tenant data or use it for advertising.
Retention and security
Findings and reports are kept for the period required by the customer's service agreement and evidence needs, then returned or deleted under that agreement. Operational records and backups follow EdTech's documented retention arrangements. Access is limited by role, and the service uses encryption and audit controls. A customer's administrator may revoke the Entra application's consent in their tenant; revocation stops new collection but does not itself delete existing reports.
Questions and individual rights
For requests about a school or trust's tenant data, contact that organisation as controller; EdTech will assist it under the service agreement. For questions about this statement, EdTech's own business contact data, or a privacy concern, email hello@edtechsolutions.uk.
See also the scanner terms of service.