Privacy notice

Last updated: July 2026

Student MFA provides multi-factor authentication services to education organisations. This notice explains what personal data the platform processes, why, and the choices available to the organisations we serve.

Our role

For learner and staff data, Student MFA acts as a data processor on behalf of the subscribing organisation, which remains the data controller. We process this data only on the organisation's instructions, given through the administration portal and the service agreement.

What we process

• Learner directory data: display name, sign-in username (UPN) and directory identifier, imported by the organisation from its own Microsoft 365 directory.
• Authentication data: a one-way bcrypt hash of each learner's PIN, encrypted pattern data, and passkey public keys. PINs are never stored or displayed in clear text after issue.
• Optional contact data: a recipient email address per learner (a parent, guardian or tutor), if the organisation enables email delivery of PINs and pattern codes.
• Administrator data: name, email and role of portal users.
• Audit and sign-in events: timestamps and outcomes of authentication challenges and administrative actions, retained for security and accountability.

What we do not process

• No lesson content, coursework, grades or safeguarding records.
• No passwords — primary authentication stays entirely with Microsoft.
• No advertising, profiling or sale of data, ever.

Where data lives

The platform is hosted on Microsoft Azure in the United Kingdom. Data is encrypted in transit and at rest. Each organisation's data is isolated by tenant identifier at the database layer.

Retention and deletion

Organisations can offboard at any time from the portal. Offboarding reverts every configuration change made in the organisation's Microsoft tenant, and the organisation may additionally request permanent deletion of all platform data, which is executed immediately and irreversibly.

Access to your Microsoft tenant

The platform operates through permissions granted explicitly by the organisation's own Global Administrator. These permissions are limited to what the service requires and can be revoked by the organisation at any time, with or without our involvement.

Contact

For privacy questions or data subject requests, contact privacy@studentmfa.co.uk or write to The Old Corn Mill, Congleton Road, Macclesfield, SK11 9JR. Data subjects (learners, parents, staff) should contact their organisation first, as the data controller.