Safety and Privacy Protocols

This policy explains how the ALFI + EDIE Framework approaches safety and privacy in AI-assisted chats, coaching tools and uploads, and how learners, families, schools and staff can raise a concern.

It sits alongside, and does not replace, the Ethical AI Policy, Privacy Policy, Security Policy and Accessibility Policy. Where another policy sets out fuller detail on a related topic, this page links to it rather than repeating it.

AI supports people; it does not replace them. ALFI, EDIE, SAMU and TRAC are designed to help a learner, parent, educator or professional think something through, not to make decisions for them or to stand in for a qualified person.

Human oversight applies to consequential matters. Where a chat, output or flag could affect someone's safety, wellbeing, assessment or rights, a named human reviews it before any significant action is taken. AI suggestions are a starting point for that human judgement, not the final word.

Before a feature reaches users, we run structured tests covering misuse scenarios, prompt-injection attempts, harmful-output checks and age-appropriateness for the audience the feature is built for.

A member of staff with safety responsibility reviews the test results and signs off the release. Features that do not pass this review are held back or restricted until the issues are resolved.

A server-side safety screen checks every message before it reaches the AI model. If a message contains crisis signals, the system returns a fixed, supportive reply with UK help routes rather than passing the message on for an open-ended AI response.

Personal details that commonly appear in chat — such as email addresses, phone numbers, card numbers, National Insurance numbers and postcodes — are redacted before the message reaches the AI model.

Attempts to override system instructions (instruction-injection) are fenced off from the rest of the conversation and logged for review. They are not treated as ordinary user requests.

SAMU and TRAC are built to coach — prompting, questioning and guiding — rather than to complete assessed work on a learner's behalf.

Features used by learners in Years 7–11 are designed with safeguarding in mind. If a conversation suggests a learner may be at risk, the response points them towards a trusted adult, their teacher or their school's designated safeguarding lead.

Where a message suggests someone may be in crisis, the fixed response includes a reminder to call 999 in an emergency, Samaritans (116 123, free, 24 hours), Childline for under-19s (0800 1111) and SHOUT text support (text SHOUT to 85258).

EDIE and the wider Framework are not a substitute for therapy, counselling or crisis care. They are learning and coaching tools, not a clinical or emergency service.

We apply data minimisation: we collect and pass on only what a feature needs to work. Learners and account holders have consent controls for chat history, personalisation and uploads, and can review or withdraw consent at any time.

Access to stored data is controlled at row level, so a user's records are only visible to the people and systems that need them. Where a conversation is flagged for safety reasons, the flag records the category of concern only — never the message text itself.

Full detail on what we collect, why, and the rights you can exercise is in our Privacy Policy.

Named staff are accountable for safety testing, sign-off and ongoing review of AI features. Logged instruction-injection attempts and safety flags are reviewed by a human, and patterns inform future testing and feature changes.

Where an AI system behaves unexpectedly, staff can restrict or disable the affected feature while it is investigated.

If something a chat said or did concerns you, or you believe a safety or privacy protocol was not followed, please get in touch so we can look into it.

We draw on the themes set out in the UK Government's policy paper 'Introducing the AI Safety Institute' (Department for Science, Innovation and Technology, updated 17 January 2024) as context for our own evaluation and research practice. This reference does not imply AI Safety Institute endorsement of, or involvement in, the Framework, and we make no claim of legal or regulatory compliance by citing it.

The safeguarding wording, privacy wording and this page as a whole were approved by Andy Wake, acting as safeguarding lead, data protection lead and product owner, on 10 October 2026.