Starlight is becoming useful in more parts of school life. Alongside lesson reflection and coaching, users are finding value in meetings, conversations with parents and the everyday work of turning discussion into action.
We are delighted to see that versatility. It also gives us a clear responsibility: as Starlight grows, our security, privacy documentation and safeguards must develop with it.
That is why we have introduced multi-factor authentication (MFA) as part of our ongoing platform review and security improvements. We have also sent an expanded Data Protection Impact Assessment (DPIA) to One West, our data protection advisers, for review.
Both developments put our Trust and Privacy Pledge into practice.
Our Trust and Privacy Pledge: control belongs with you
Trust comes from understanding what happens to your data and having meaningful choices about it.
Our pledge sets out the principles behind Starlight: supporting professional growth, protecting privacy, explaining how data is used and keeping people in control. You choose what to upload, what to share and what to delete. Your professional judgement remains central to how you use the feedback.
These principles shape everyday features as well as policy. In Your feedback, your way, we explain how teachers can choose which insights to display and whether ratings help their reflection. Choice should be visible in the experience of using Starlight.
The same care applies to collective insight. Our Department Dashboard is designed to support shared improvement through anonymised insights while protecting individual teachers' privacy.
New MFA: an extra layer of account protection
Multi-factor authentication adds a verification step when you sign in.
Once you enable it, each time you log in with your password, Starlight emails a verification code to your email address. Enter that code to complete your login.
To turn it on:
- Click your name in the bottom left-hand corner of Starlight.
- Select Settings.
- Open Two-factor authentication and turn it on.
It is a straightforward way to add protection to your account. The National Cyber Security Centre's guidance on two-step verification explains why an additional check helps protect important accounts. Keeping your email account secure matters too, because that is where your Starlight codes arrive.
A more thorough DPIA for a more versatile platform
A Data Protection Impact Assessment examines how personal data is used, what risks that could create for people and how those risks can be reduced.
We are strengthening ours to reflect the wider ways people use Starlight, including staff meetings and meetings with parents and carers. These conversations can contain different kinds of information from a lesson recording, so they deserve careful consideration in their own right.
Our meeting reports show the practical value: helping users turn a conversation into editable minutes, decisions and actions. The privacy work behind that convenience matters just as much as the report itself.
The expanded DPIA has now gone to One West for specialist review in their role as our data protection advisers. That review is in progress. We will use their advice to refine the assessment and the supporting safeguards and guidance.
This reflects the Information Commissioner's Office guidance on DPIAs: assessing risk is an ongoing process that should be revisited as the nature and scope of data use change.
Supporting schools now and preparing for what comes next
The review also looks ahead to features we are building and others in the pipeline. Our aim is to consider privacy and security during development, so the foundations are ready to support more valuable uses of Starlight.
Once the review is complete and the revised DPIA is finalised, we will share it with all our partner settings and make the updated documentation available through Starlight, alongside any relevant changes to guidance and controls.
Schools can then use that information to inform their own decisions. As the Department for Education's guidance on AI and data protection in schools makes clear, appropriate use depends on the setting and the information involved. Before recording or uploading a new kind of conversation, follow your setting's agreed procedures and make sure those involved understand how the recording will be used.
Our ambition is for Starlight to save you more time and support more of the work that matters. Earning your trust is part of that work, every day.
Read our Trust and Privacy Pledge, explore your account settings and switch on MFA when you next log in.
Featured photograph: Headway on Unsplash.
