This policy forms part of the Terms of service. It applies to your organisation and to every person your organisation gives access to. When someone joins your organisation on this site, they confirm they will follow it.
You may
- Use your engagement code to complete the assessment for the tool named in your engagement, on behalf of your school.
- Save drafts and return later using the same code.
- Keep your organisation's register of AI tools and intended uses on the service, record your decisions, actions and review dates, and download your organisation's governance summary.
- Invite people to your organisation in the roles the service offers, and remove their access.
- Publish your Decision Passport and its verification link.
- Verify any Passport at verify.anaxstandard.ai.
You must not
- Share an engagement code or an invitation link outside your organisation, use a code or link issued to another organisation, or accept an invitation you were not meant to receive.
- Let another person use your signed-in session, or sign in as someone else.
- Enter pupil names, pupil records, safeguarding case details, health or SEND information, or any other personal data that is not needed into the register, an action, a note or an assessment answer. None is needed: people are identified by role.
- Give answers you know to be untrue, record a decision you are not authorised to make, or act on behalf of a school you are not authorised to represent.
- Attempt to reach another school's or trust's records, or to probe, scan, overload or bypass the service's security, authorisation or rate limits, except as permitted under "Security research" below.
- Reverse-engineer the service, scrape the verification service in bulk, or present a Passport as covering a tool, school or period it does not.
- Describe an outcome, a decision recorded on the service or the word "verified" as a legal opinion, a certification, a regulatory approval or an inspection result (see the words we use).
Your organisation's responsibilities
Your organisation decides who holds access and in which role, keeps that list current, and removes people who leave. A trust administrator acts for every school in the trust; a school administrator for that school. Decisions recorded on the service are your organisation's decisions, made by the people it authorised.
What we do if the policy is breached
We may suspend or revoke an engagement code, an invitation or a person's access, hold or withdraw a Passport, suspend an organisation's access where necessary for security, and tell your organisation's administrator why. Where we reasonably believe a breach involves a crime, we may report it.
Security research
We welcome good-faith reports of security weaknesses. Email contact@viccaone.com with "SECURITY" in the subject (see how to report a vulnerability). Testing that stays within these limits is authorised by us for the purposes of the Computer Misuse Act 1990: do not access, alter or exfiltrate data that is not yours beyond what is needed to demonstrate the issue; do not degrade the service for others; do not use social engineering or physical attacks; stop and report as soon as you have enough to show the weakness. We will acknowledge within 2 working days and will not pursue research that respects these limits. We do not run a bounty programme.
Version history: 0.1 (11 October 2026) prepared; 0.2 (12 October 2026) website candidate — security-research limits made explicit, bounty position stated; 0.3 (26 October 2026) the signed-in register, invitations, roles and the pupil-data boundary added. 1.0 (3 November 2026) — in force under the Terms of service; the pilot reference removed.