What we process
The answers a privacy assessment asks for. Your own deployment states most of this for itself under Admin, Compliance, and that is the version to screenshot, because it reflects your configuration.
What is held
Section titled “What is held”| Category | Examples | Where it comes from |
|---|---|---|
| People | Names, year levels, tutor groups, usernames, email addresses, student numbers, card numbers | Your SIS and directory |
| Devices | Serials, models, assignment, lifecycle fields | Your MDM, and records created here |
| Work | Submissions, tickets, notes, statuses, outcomes, costs | Created in Plugboard |
| Loans | Which device, to whom, when | Created in Plugboard |
| Money | Purchases, damage charges; 0.12.0-rc.3 candidate software contracts, free-text owners, seat entitlements and reminder recipients | Created in Plugboard |
| Execution records | Automation runs and approvals; 0.12.0-rc.3 candidate owner-scoped bulk device jobs and target outcomes | Generated from requested work |
| Staff accounts | Names, emails, roles, MFA enrolment | Created here, or SCIM |
| Audit | Who did what, when | Generated |
| Configuration | Modules, workflow, templates, encrypted connector credentials | Created in Plugboard |
| Network client sightings | Which access point or switch port a device was last seen on, and when | Your network equipment, only if you switch client tracking on |
Special categories
Section titled “Special categories”Plugboard does not provide dedicated fields for health data or ethnicity. Free-text fields and attachments can still contain sensitive information entered by a user; the platform cannot promise that no such information is held.
Free-text notes on submissions and tickets can contain anything a staff member
types. A note explaining why a family cannot pay for a repair might touch on
sensitive circumstances. Restrict who reads those notes with the
ticket.internal permission, and tell your staff what belongs in a note.
Where it goes
Section titled “Where it goes”External processing depends on enabled connectors, hosting, email and AI settings. Managed plans that include AI can receive an enabled vendor AI connector during bootstrap. Review the actual connector list instead of assuming no outbound processing until a technician configures one manually.
| Category | What leaves |
|---|---|
| MDM | Device serial numbers, models, assignment and compliance state |
| SIS | Student and staff names, year levels, identifiers and email addresses |
| Directory | Names, usernames, email addresses and group membership |
| Message content and recipient addresses | |
| SMS | Phone numbers and message content |
| Ticketing | Ticket subject, body and requester details |
| Warranty | Serial numbers |
| Repair vendor | Serial numbers, fault descriptions and contact details |
| Security | Device identifiers and application approval requests |
| CRM | Account and contact details |
| Printing | Usernames, card numbers and print balances |
| AI | Ticket text and what you ask the assistant. Where it goes depends on which of the three AI connectors you configured |
The table is by category rather than by vendor, so swapping Jamf for Intune does not change the answer.
Your compliance page lists only the connectors you have enabled, so it describes your deployment.
Sub-processors
Section titled “Sub-processors”Self-hosted: the school operates the application and database. Its chosen connector, email, backup and external AI providers may process data. Licensing and optional count-only usage reporting also contact the vendor. A local AI model avoids external inference; self-hosting alone does not disable connectors.
Managed: the full list is below.
| Sub-processor | Purpose | Customer data |
|---|---|---|
| Hosting provider for your region | Runs the stack, holds the database | Yes |
| Cloudflare | Ingress, access control and request observability | Traffic and request metadata; retention depends on the configured service |
| Object storage in your region | Encrypted backups | Yes, encrypted |
| DigitalOcean | Assistant inference, only on managed plans that include hosted AI, on open-weights models DigitalOcean serves itself. No other AI vendor sees this text | Pseudonymised ticket text and prompts |
| Configured email provider | Notifications and reminders | Recipient addresses and message content |
The managed application database and regional backup destination are configured for the agreed region. Connector calls, email, external AI and edge services have their own processing locations. The application region is not a guarantee that all processing occurs there. Confirm backup replication and provider locations in your deployment agreement.
Count-only usage reporting excludes school records and ticket content. Billing, support and contact records are separate business records and can identify the people administering or purchasing the service. Website analytics and walkthrough bookings are covered by the website privacy policy.
Telemetry
Section titled “Telemetry”A deployment reports count-only usage: technician accounts, managed devices, enabled modules, version, deployment id.
It carries no names, records, serials, credentials or content.
Self-hosted deployments can disable it entirely with
USAGE_REPORTER_DISABLED=1, and export local snapshots instead. See licence and
plan.
Where AI fits
Section titled “Where AI fits”Ticket text reaches a language model through the selected AI connector. Managed deployments whose licence includes hosted AI can have this connector provisioned automatically. The options differ:
- The bundled model runs inside your own deployment and sends nothing anywhere.
- Anthropic and an OpenAI-compatible endpoint send it to whoever you point them at, on your own key.
- Vendor-hosted AI, on managed plans that include it, sends pseudonymised ticket text to DigitalOcean, processed in the United States, on open-weights models DigitalOcean serves itself (gpt-oss-120b, NVIDIA Nemotron 3 Ultra and BGE-M3). DigitalOcean is the only AI sub-processor for vendor-hosted AI; the text never reaches a model’s creator.
With no AI connector configured, an offline command engine handles the assistant and nothing leaves.
This covers the assistant. It does not cover a third-party MCP client you connect yourself, because that client hands results to whatever model it uses. Scope API keys accordingly.
For an assessment: the AI connector you configured decides where ticket text goes, Admin, Compliance names it, and connecting an external MCP client is a separate decision.
Live identity information
Section titled “Live identity information”Identity panes and the candidate licence-position report fetch provider data on demand and do not persist sign-in history, MFA methods or licence inventories. The software register stores manually entered commercial terms and exact SKU mappings. Privileged action audit records retain the target, technician, reason and outcome. Exchange delegation uses an encrypted PFX credential and private temporary files removed after the subprocess exits. These are distinct from persisting a provider inventory.
Sentiment and staff experience
Section titled “Sentiment and staff experience”From 0.19.3, two things are inferred, both for staff to read. See sentiment & staff experience for who can see each.
Ticket sentiment. Read from the requester’s own messages on a ticket — never staff replies — and stored on the ticket as a tone, an urgency, a short list of signals and one line of reason. With AI configured, it comes from the ticket brief’s own call and is pseudonymised the same way. Without AI, rules read it from facts the desk already holds, and it is labelled Rules. It exists for every ticket, whoever raised it, and is never shown to the requester, in the portal, to parents or at a kiosk. It lives on the ticket, so it is deleted with the ticket under your retention policy.
Staff experience. A nightly 90-day summary, kept for staff only: median time to first reply, reopen rate, chases per ticket, average satisfaction, the share of tickets that read as frustrated, and a score computed from those numbers. With AI on, one sentence may be added for a staff member having a rough time, written from the numbers alone — no names and no ticket text are sent. A row not refreshed for 7 days is deleted, which covers somebody who has left or changed role.
Nothing per-person is ever computed or stored for a student or parent. No emotional profile of a student or parent exists; their experience appears on the Experience report only as school-level totals, never as a row, a name or a score.
Erasing a person clears the sentiment on tickets they raised, deletes their staff experience row, and deletes the AI readings behind both. A staff member’s subject-access export includes their staff experience row.
Network client sightings
Section titled “Network client sightings”Off unless you turn them on, under Admin, Security. They are the one category in the table above that is location information, and most of the devices on a school network belong to students, so the decision is deliberately yours to make rather than something that arrives switched on with a connector.
With it on, Plugboard keeps one row per device — the access point or switch port it last connected to, and when — not a history of where it has been. Rows older than your window are deleted automatically; the window is between 1 and 90 days, defaults to 7, and there is no “keep forever” setting for this.
Sightings appear in a subject-access export and are removed by an erasure, the same as everything else in the table above. They are never shown on the student or parent portal.
Retention and erasure
Section titled “Retention and erasure”Covered in audit and retention. Retention is configurable, and erasure is built in rather than a manual database edit.
Getting data out
Section titled “Getting data out”Admin, Backups exports a portable copy of your own institution at any time, without asking us. See backups in the app.
Related
Section titled “Related”- Compliance answers, the version your deployment states for itself.
- Regions and data residency.
- The security model.