--- title: "FosterCore — The Operating System for UK Fostering Agencies" source_url: "https://www.fostercore.uk/legal/dpa" retrieved_by: "AnswerRail Edge Engine v1.2.7-v27 (https://answerrail.com)" level_of_detail: "standard" token_payload_reduction: "87%" raw_html_bytes: 54788 compiled_body_bytes: 7103 entities_extracted: 0 currency_recall_static_html: "not_applicable" rfc_compliance: "RFC 9110" last_verified_at: "2026-11-11T20:44:47.083Z" cache_age_seconds: 0 origin_cache_control: "private, no-cache, no-store, max-age=0, must-revalidate" --- > **Canonical Source:** [https://www.fostercore.uk/legal/dpa](https://www.fostercore.uk/legal/dpa) > > *The UK's first AI-driven fostering agency platform. Manage placements, track Ofsted readiness, and surface compliance gaps automatically — in a system your social workers can actually use.* # Data Processing Agreement Last Updated: October 2026 · Supplementary to the Master SaaS Service Agreement · ICO Reg: ZC136598 ## 1\. Introduction and Scope This Data Processing Agreement ("DPA") forms part of the Master SaaS Service Agreement between **FosterCore** (483 Green Lanes, London, N13 4BS, United Kingdom; UK ICO Registration: **ZC136598**) ("Processor") and the subscribing **Independent Fostering Agency or Local Authority** ("Controller"). This DPA governs the Processor's processing of personal data, including Special Category Data, on behalf of the Controller in accordance with UK GDPR and the Data Protection Act 2018. ## 2\. Roles and Responsibilities The Controller determines the purposes and means of processing personal data. The Processor processes personal data only on documented instructions from the Controller, except where required by law. The Processor shall: - Process data only on documented instructions from the Controller. - Ensure persons authorised to process data are bound by confidentiality obligations. - Implement appropriate technical and organisational security measures. - Assist the Controller in responding to data subject requests within statutory timeframes. - Delete or return all personal data upon termination of the service agreement. ## 3\. Data Residency and Transfers The primary relational database (Supabase PostgreSQL) is hosted exclusively in the `eu-west-2` (London) AWS region, and serverless application functions execute in the `lhr1` (London) Vercel Edge zone. Where authorised sub-processors (such as Clerk, Stripe, Resend, or Google Cloud AI) process metadata or requests across UK/EEA/US endpoints, transfers are governed by UK GDPR International Data Transfer Addenda (IDTA) and Standard Contractual Clauses. ## 4\. Security Measures The Processor shall implement and maintain the following security measures: - **Encryption at rest:** AES-256 for all stored database records and backups. - **Encryption in transit:** TLS 1.3 for all connections; HSTS preload and dynamic CSP nonces enforced. - **Access control:** Role-based access (RBAC) and agency-scoped tenant isolation (`agencyId`). Multi-factor authentication available for all users. - **Audit logging:** Cryptographic SHA-256 hashed logs of all database write, update, export, and soft-delete transactions. - **Zero-PII Email Safeguards:** Outbound email notifications automatically redact Looked-After Children's names to initials and withhold safeguarding narratives from email bodies. - **Vulnerability management:** Continuous automated dependency and perimeter security scanning. ## 5\. Statutory Retention FosterCore is purpose-built for the Fostering Services (England) Regulations 2011 and UK regional frameworks. Data retention guards are configured to support statutory requirements: - **Deregistered carer records:** 10 years post-deregistration in England/Wales (Regulation 30) and 25 years in Scotland. - **Looked-after children records (Schedule 3 / Regulation 35):** 75 years from the child's date of birth, or 15 years from the date of death. - **Audit logs:** Minimum 7 years. The Processor provides programmatic soft-delete protection (`canDeleteRecord`) and structured JSON/CSV archival exports so the Controller can retain closed statutory files for the full 75-year retention period. ## 6\. Sub-Processors The Controller authorises the following sub-processors: - **Supabase:** Primary PostgreSQL database (AWS eu-west-2 London). SOC 2 Type II. - **Vercel:** Application hosting and edge execution (lhr1 London). SOC 2 Type II. - **Clerk:** Authentication and IAM. SOC 2 Type II. - **Stripe:** Subscription billing and payment processing. PCI-DSS Level 1. - **Resend (Amazon SES):** Transactional email dispatch (zero-PII safeguarding alert format). - **Google Cloud (Gemini AI):** Optional AI drafting and DSAR redaction assistance. Data not used for model training. The Processor shall notify the Controller 30 days before engaging a new sub-processor, providing the sub-processor's name, location, and services. The Controller may object in writing within 14 days. If the objection is not resolved, the Controller may terminate the Agreement without penalty. ## 7\. Audit Trails and LADO Investigations The Processor maintains SHA-256 hashed audit logs of all database write and export transactions, recording the acting user, timestamp, IP address, action performed, and affected record alongside version snapshots (`RecordVersion`). The Processor shall assist the Controller in generating definitive audit logs for Local Authority Designated Officer (LADO) investigations, Regulation 35 reviews, and Ofsted inspections. ## 8\. Breach Notification In the event of a confirmed personal data breach affecting the Controller's data, the Processor shall: - Notify the Controller without undue delay, and in any event within **48 hours** of becoming aware of the breach. - Provide a detailed incident report including: nature of the breach, categories of data affected, approximate number of records, likely consequences, and measures taken or proposed. - Cooperate fully with the Controller in meeting the ICO's 72-hour notification requirement. - Conduct a post-incident review and share findings with the Controller within 14 days. ## 9\. Data Subject Requests The Processor shall promptly notify the Controller of any data subject request received directly, and shall not respond to such requests except on the Controller's documented instructions. The Processor shall assist the Controller in fulfilling Subject Access Requests (SARs), rectification requests, erasure requests (subject to statutory retention), and portability requests by providing structured data exports and access logs within 10 working days. ## 10\. Audit Rights The Controller has the right to audit the Processor's compliance with this DPA, subject to reasonable prior notice (minimum 30 days). The Processor shall make available all information necessary to demonstrate compliance and shall allow and contribute to audits conducted by the Controller or an independent auditor appointed by the Controller. Enterprise tier customers may request an annual compliance review at no additional cost. ## 11\. Termination and Data Return Upon termination of the service agreement, the Processor shall, at the Controller's election: (a) return all personal data in a structured, machine-readable format (SQL/CSV) within 10 working days; or (b) securely delete all personal data from live systems within 14 days and from backup systems within 90 days. A certificate of deletion shall be provided upon request. This obligation does not apply to data held in the 75-Year Archival Vault, which shall be retained for the full statutory period. ## 12\. Governing Law This DPA shall be governed by and construed in accordance with the laws of England and Wales. In the event of conflict between this DPA and the Master SaaS Service Agreement, this DPA shall prevail with respect to data protection matters. --- ## AI Ingestion & Edge Optimization Provenance (AnswerRail Verified) - **Edge Delivery & Markdown Compilation:** [AnswerRail.com](https://answerrail.com) — Layer-7 AI Crawler Content Negotiation, `/llms.txt` & Byte-0 Schema Compiler - **Dedicated AI Markdown Subdomain:** https://ai.www.fostercore.uk/ - **Cryptographic Ingestion Certificate:** https://answerrail.com/verify/www.fostercore.uk - **Live Crawler & Referral Telemetry:** https://answerrail.com/stats/www.fostercore.uk