Security and hosting.
Admit holds applications for nursery, primary and secondary places on behalf of Scottish councils.
This page sets out where that data lives and how it is protected. We keep it current.
Hosting and assurance
UK-only hosting
Hosted on AWS in the London region, eu-west-2.
Cyber Essentials
Certified. Renewed January 2026.
Penetration testing
Independent pen tests by WorkNest Secure, every year since 2023.
Data Protection Officer
Our DPO service is provided by WorkNest Secure, formerly Bulletproof.
Access and accountability
Who can get in, what they can do, and a record of what they did.
MFA
Multi-factor authentication on every account.
Role-based access
Each user sees and does only what their role allows.
Audit logging
Decisions and changes are logged, with who made them and when.
Resilience and upkeep
We run hosting, security and patching. All three are included in the licence.
Backups and BCDR
Data is backed up, and we keep a business continuity and disaster recovery plan. Details on request.
Patching
We patch the platform and its dependencies. Critical patches go out as soon as they are ready. We normally apply them before the working day, with a short planned outage. An urgent fix can go out during the day.
Browser-based
Admit runs in the browser. There is nothing to install.
Your data
Sub-processors
AWS for hosting and MongoDB Atlas for the database, both in the UK. The full list is available on request.
Data export on exit
Your data is yours. It can be exported if you leave.
Works with any MIS
Admit does not depend on one. Data goes out as CSV, for any system to take in.
For IT and procurement
The stack, the compliance and the contract, in one place.
How to buy
G-Cloud 15, Softcat or Quick Quote.
Support desk
Support comes from the team that builds Admit, through our service desk.