The Tenancy Test

A one-minute diagnostic for a chief executive, a trustee, a superintendent or a ministry director. Ask it of the supplier you depend on most, without notice.

If we closed that account tomorrow, what do we still hold? Student records, admissions, parental communication, curriculum delivery, the workflows our staff have tuned over three years, the evidence of what worked. Or does the capability disappear with the login?

A tenant pays for access. An owner accumulates an asset. Most schools are paying owner prices on tenant terms, and the difference only becomes visible at the moment of exit, which is the moment it is least useful.

Score it honestly. For each line, mark hold or lose.

If the contract ends on FridayWe hold itWe lose it

The pupil record, in a format another system can read☐☐

Three years of parental communication history☐☐

The workflows and templates our staff built inside it☐☐

The evidence of which interventions worked, and for whom☐☐

The audit log of who accessed what, and when☐☐

Continuity of service for pupils during the following week☐☐

Reading the result. Every line marked lose is a dependency you are paying for and do not own. Two or more is not a procurement problem to raise at renewal; it is a governance exposure to raise at the next board meeting, because renewal is the moment your leverage is lowest.

Extracted from Education in the Age of the Builder, Educave Research Series 01. Free to copy, forward and use inside your trust, with attribution.

Educave Research · Extract 02

educave.ai

The Sovereignty Specification

Five properties that can be verified rather than promised. Paste them into an invitation to tender, or read them down the phone. A supplier who cannot describe its data path in one paragraph a governor understands has answered the question.

1. Read-only access to the management information system

No write-back. The system of record stays the system of record, and nothing an external tool infers can quietly become a fact inside it.

2. Tokenisation and redaction before any external model call

Named pupils do not leave the boundary. Identifiers are substituted before the request and restored only for the accountable adult who receives the answer.

3. The school chooses the model provider

Consistent with relationships and data agreements the institution already holds, and changeable without rebuilding the estate.

4. Role-scoped views

A board sees aggregate patterns. Named-pupil records stay with the people who owe that child a duty of care.

5. A school-held audit log of every query, export and model call

This is the property that makes the other four verifiable rather than promised. If the log sits with the supplier, the assurance sits with the supplier.

Two questions that separate residency from sovereignty

Where is the data processed, and under whose law is the processing company incorporated? A European or Gulf data centre operated by a company incorporated elsewhere delivers residency, not sovereignty.