Built for Australian Schools

The Safer Technologies for Schools (ST4S) framework is the Australian national standard for evaluating the safety of educational technology products. It covers data governance, AI transparency, parental consent, incident response, duty of care, and privacy protection. Qwizflow was designed from the ground up to meet every ST4S requirement. Specific compliance measures include: granular parental consent for all AI features (children under 16 cannot self-consent); student data stored exclusively in Firebase’s Melbourne region; personal information scrubbed before any data reaches AI providers; duty-of-care safety flags for teachers; full incident response plans documented and tested; consent audit trails for every change; and published sub-processor registers in our Privacy Policy. Qwizflow maintains comprehensive compliance documentation including an Information Security Policy (QF-ISP-001), Continuous Monitoring Plan (QF-CMP-001), Business Continuity Plan (QF-BCP-001), Disaster Recovery Plan (QF-DRP-001), Incident Response Plan (QF-IRP-001), and Secure SDLC Process (QF-SDLC-001).

All student data is stored in Firebase’s australia-southeast2 (Melbourne) region. The database has point-in-time recovery (PITR) enabled with a 7-day recovery window, delete protection enabled to prevent accidental data loss, and daily automated backups to Google Cloud Storage at 2 AM AEST. AI text generation uses Google’s Vertex AI in the Sydney region (australia-southeast1). Some supporting services — specifically image generation and Firebase Authentication — are processed in the United States under Google’s Data Processing Addendum, which provides contractual privacy protections equivalent to Australian standards. Data is encrypted in transit using TLS 1.3 and at rest using AES-256. No student data is ever used to train AI models, and personal information is scrubbed by our PII-scrubbing pipeline before any content is sent to AI providers.

The School Admin Dashboard provides a centralised management interface for school leaders. Administrators can create and manage the school entity, approve or reject teacher registrations (teachers sign up with a school invite code TCH-XXXX and require admin approval before accessing classroom data), set school-wide AI feature policies that override individual settings, view aggregated usage data across all classrooms, and generate compliance reports for auditors or education department reviews. The dashboard also shows consent adoption rates across the school — how many parents have set up accounts, how many have reviewed AI consent settings, and which features are most commonly enabled or restricted. This gives school leaders visibility into platform adoption without accessing individual student data.

Qwizflow implements a comprehensive granular consent system. Each AI feature — Socratic Tutor, Homework Helper, Story Writer, Quiz Explanations, Study Guides, Debate Arena, AI Roleplay, Voice Features, and Adaptive Learning — has an individual consent toggle. For children under 16, only a linked parent or guardian can grant consent. Students aged 16 and above can self-consent, though parents retain override ability. When multiple parents are linked to a student, the most restrictive consent setting automatically applies, and both parents are notified of changes. All consent changes are recorded in an immutable audit trail. Parents access the AI Consent Centre from their Parent Dashboard, where each feature includes a plain-English explanation of what it does, what data it processes, and where that data goes.

Yes, Qwizflow is completely free for all schools, with no exceptions. There are no licence fees, no per-seat or per-student charges, no setup costs, no annual subscriptions, no premium feature tiers, no advertisements, and no data monetisation. Every feature available in Qwizflow — including the AI teaching copilot, classroom analytics, curriculum heatmaps, live quizzes, safety flags, predictive analytics, the school admin dashboard, parental consent controls, and all student-facing AI features — is included at no charge. Qwizflow is funded independently with the explicit mission of ensuring equitable access to AI-powered education for every Australian student, regardless of whether they attend a well-resourced independent school or an under-funded rural government school.

Qwizflow’s content is mapped to the Australian Curriculum v9 and the Victorian Curriculum 2.0. Every learning path, quiz, and study guide is tagged by year level, subject strand, and content descriptor. The Teacher Dashboard includes a curriculum heatmap that visualises coverage — green for topics the class has mastered, amber for topics partially covered, and red for curriculum areas not yet started. Teachers can identify gaps against expected Term coverage and generate targeted assignments to address them. Adaptive quizzes automatically adjust difficulty based on student performance within the curriculum framework. When new curriculum versions are released, Qwizflow’s content mappings are updated to maintain alignment, ensuring that what students practise on the platform directly supports what they are learning at school.

The safeguarding escalation ladder is a server-enforced 5-step state machine for handling student wellbeing concerns: open → acknowledged → actioned → resolved → dismissed, with a separate escalation path to a named school counsellor. Every transition requires a non-empty note that becomes part of an append-only, immutable audit trail. School admins configure the named counsellor (name, email, phone) in the School Admin dashboard, plus an optional NotifyParentOnEscalate toggle. Without a configured counsellor, no flag can be escalated — the system returns a 409 SAFEGUARDING_NO_COUNSELLOR error to prevent flags being silently sent to nobody. The state machine is mirrored on both backend and frontend so disallowed transitions are blocked before they can be submitted. The full audit trail per flag is queryable for school records, mandatory reporting, and any external review.

Qwizflow publishes a sub-processor register inside the Privacy Policy listing every AI provider, the data they process, the geographic region, and the contractual privacy protection in place. As of May 2026 the active providers are Google Vertex AI / Gemini (text generation, Sydney australia-southeast1), Google Cloud Text-to-Speech (voice synthesis, Sydney australia-southeast1, Chirp 3 HD voices), Google Cloud Storage (audio cache, australia-southeast1), and Firebase (auth, Firestore, hosting — Melbourne australia-southeast2). Each AI feature surfaces its sub-processor to parents through the Transparency Ledger so they can see exactly which provider handled each interaction. New sub-processors are never added silently — Privacy Policy updates require parent re-consent under the ST4S framework.