Edsthetic policy
A practical 15-minute guide for school coordinators, teachers, learning support officers, and leadership using Writeiq and Allocateiq. Written to be read once, remembered, and referred to when something unusual happens.
Writeiq and Allocateiq hold student writing, assessment data, and learning support information. Much of that data is sensitive under Australian privacy law, and all of it is personally meaningful to the students and families it concerns. Looking after it well is a shared responsibility between Edsthetic and the schools using the products.
This document is not a legal checklist. It is a practical guide for staff who use Edsthetic products, written to be read once, remembered, and referred to when something unusual happens.
Edsthetic products use role-based access. Understand which role applies to you and don't try to bypass it.
If you need access the product won't grant you, speak to your coordinator. Don't log in with another staff member's credentials.
A licence key is what proves your school has bought access. Anyone with the key can connect the product to your school's data.
If a licence key is accidentally shared or posted somewhere public, tell your coordinator immediately. Your coordinator can request a key rotation from Edsthetic and the old key is revoked within one business day.
Admin, Leader, and Coordinator PINs control access to staff features. Students should never see them on screen, on sticky notes, or in printed material.
New schools get default PINs of 110211 (admin) and 220422 (leader). These are publicly documented defaults — they are not secret. You must change them on first login.
Good PINs:
123456 or patterns like 112233Reasonable PINs:
Edsthetic stores PIN hashes using PBKDF2-SHA-256 with 600,000 iterations and a per-account salt. This means that even if our database were compromised, your PIN cannot be recovered by a brute-force attack in any reasonable timeframe. But a PIN like 123456 defeats this protection because an attacker can guess it in one try.
If you're on a shared device, log out of the product when you finish. Writeiq and Allocateiq session tokens expire automatically, but an active session on a shared laptop is a trivial way for the next user to see data they shouldn't.
Attacks on education systems often come through email pretending to be from a service the school uses. If you receive an email claiming to be from Edsthetic and it asks you to click a link and enter your PIN, confirm by emailing hello@edsthetic.com.au directly.
Edsthetic will never:
· Email you a link that asks you to enter a PIN or licence key
· Ask you to install software onto a student or staff device
· Request your PIN by SMS, phone, or email
· Ask you to pay for anything by bank transfer outside the invoicing process
Writeiq lets you export reports as PDF and download submission bundles. Allocateiq lets you export schedules and NCCD summaries. Only export what you need and only to a device that is school-managed, encrypted, and under your control. Don't email exports to personal email addresses or upload them to personal cloud storage.
Screenshots of submission feedback are a common and legitimate teaching tool. But screenshots live forever once they leave a device. If you screenshot Writeiq feedback for professional learning, remove student names and class identifiers before sharing. For internal professional learning with colleagues at your own school, de-identification is still strongly recommended.
Report any of the following to your coordinator as soon as possible, who will in turn notify Edsthetic:
The rule of thumb: if you would tell your principal about something, tell your coordinator too. Edsthetic takes small signals seriously.
Short, factual report to your coordinator by email or direct message:
Your coordinator forwards this to hello@edsthetic.com.au with "Security" in the subject line. Edsthetic acknowledges within two business days and triages per our Incident Response Plan.
Allocateiq holds data related to the Nationally Consistent Collection of Data on School Students with Disability (NCCD). This data is sensitive under state and federal law and requires particular care.
When a new staff member joins, add them to the product through the admin interface. Don't share an existing account.
When a staff member leaves, remove their access on their last working day. A departing staff member with active credentials is the most common source of leaked educational data; it is also the most preventable.
At least once per term, log into the admin interface and review the list of staff accounts. Remove any that no longer belong. Confirm PINs are not set to defaults for any active account.
The coordinator email and phone number on your school's licence record are what Edsthetic uses to contact you during incidents. Keep these current by editing your school's record in the admin interface or by emailing us.
If your school's privacy officer, head of IT, or principal changes, let us know by email. We update our records and make sure incident notifications go to the right people.
So you know what to expect from us:
Our current security commitments are documented in detail on our Security page.
Most common things to remember:
110211 and 220422 are not secret.Schools should ensure all staff with Edsthetic access have read this document once before using the product for the first time, and once per year thereafter. Coordinators are responsible for recording completion at the school level.
Edsthetic updates this document as threats and products change. Material updates are announced by email to the school coordinator.
Questions about this training: hello@edsthetic.com.au
Security incidents: hello@edsthetic.com.au with "Security" in the subject line
General support: hello@edsthetic.com.au
Related documents: Security & Privacy · Data Deletion Policy · Incident Response Plan · Data Processing Agreement (PDF)