Security and privacy, designed in from the start
School transport records describe children: where they live, which school they go to and how they travel. PassChirp is built so that each person sees only what their job needs, and every access can be accounted for.
Operator accessServices WF14, WF15
Where data lives and who can see it
Primary data hosted in the UK
The main PassChirp database, where pupil, family and pass records live, is hosted in the UK.Separation enforced in the database
Every council and operator is a separate organisation. Row-level security in the database means one organisation cannot read another’s records, even if there were a mistake in the application code.Sharing is explicit
An operator sees nothing until a council sets up an agreement for named services, and then only the fields the council allows.Each person sees what their job needs
Families see only their own children. Schools see only their own pupils. Eligibility reasons, such as low income, stay with the council.
Passes and phones
Signed QR codes with no personal data
A pass code is a digitally signed reference number and an expiry time. There is no name, school, route or address in it, so a photo of a pass gives nothing away.Minimal data on driver phones
A driver’s phone holds one duty list: a short name label, stop and pass references. It is encrypted and expires at the end of the service day.No location tracking
The driver app records which service and duty a check was made on. It does not use GPS, and the family app does not track children.Safe when things go wrong
A technical problem, such as an out-of-date list or a wrong phone clock, asks the driver for a manual check. It never tells them to refuse a child.
Staff and support access
Every staff look-up audited
Viewing a pupil record or checking a card is recorded with who, what and when, so councils can answer questions about access.Support access needs approval and expires
Our support staff cannot browse your data. They need a request you approve, and that access ends automatically.Two people for risky changes
Rolling back an import, and verifying a recorded payment, need a second person.Accessibility
We design and test PassChirp to meet WCAG 2.2 level AA, for staff, drivers and families.
Working with your data protection team
We can share our draft data protection impact assessment, data flow description and threat model with your information governance and data protection colleagues as part of a demo, and work through your own assessment with you.
See PassChirp working
We will walk you through PassChirp with sample routes, pupils and passes, and answer your questions about data, devices and moving from your current system.
