Secura Excursions · Educational visits management

In development Built and staged — available to demonstrate

Educational visits, from the first idea to everyone home — and the record that proves it.

Secura Excursions runs every off-site visit a council’s schools make — local, day, residential, overseas, adventurous, Duke of Edinburgh’s expeditions — against the council’s own policy, and keeps the evidence that Going Out There, an inspector or an inquiry will ask for.

Ask for a demonstration Where we are

The problem it solves

Written for education officers, outdoor education advisers, educational visits coordinators and heads.

Educational visits are governed by policy that differs between authorities, carry real risk, and produce a paper trail that has to survive scrutiny long after the coach has come home. Most of it still runs on forms, email chains and a spreadsheet somebody maintains personally.

When something goes wrong, the questions are immediate: who approved this, against which rules, what risk assessment was in place, which children were present, who held consent for what, which adults were PVG-checked, and who was contactable. Those answers should take seconds, not an afternoon of searching inboxes.

Secura Excursions answers one question at every point in a visit’s life: what does this council require of this visit, and what is still missing?

One visit, one record, eight stages

Every visit moves through the same stages. What each stage demands — the approval chain, staffing ratios, evidence, lead times — comes from the council’s published policy, and the readiness check says, in plain words, what is still outstanding and who can put it right.

Plan Proposal Three questions to start. The visit type and its facts decide which of the council’s rules apply.
Assess risk Risk–benefit Benefits, hazards, controls and a proportionality statement; standing assessments for routine visits.
Staff and consent People A team checked against ratios and the competence register; consent from whoever holds the right to give it.
Approve Decision EVC, head and council adviser in the council’s order, with working-day deadlines and conditions.
Go / No-Go Departure check Readiness re-run before leaving: outstanding consent, an unmet condition or an unread briefing stops it.
On the day Live Headcounts, groups, family updates and incidents from a phone — with or without signal.
Return and evaluate Learning Structured evaluation, final once submitted; control failures captured for the next assessment.
Close the record Closed Not while an incident is open or the books are unreconciled. Then retention takes over.

A council’s policy is one versioned document its own administrators author and test in a simulator before publishing. Changing a supervision ratio is a new policy version, not a software release — and a visit approved last year can still be explained against the rules that applied on the day.

What it covers

Everything below is built and running in our staging environment. Where something is optional, off by default, or depends on the council, we say so.

Your council’s policy, not ours

Rules matched on visit type, residential, overseas, adventurous, water, nights away, numbers, ages, additional support needs, destination country and school — the strictest answer wins
Visit types, templates and recurring series (forty weeks of swimming, planned once), and a calendar that shows who is away and which teacher is booked twice
A guided onboarding that reads a council’s existing procedures into a draft policy, imports staff and roles, and picks schools from the national directory

Risk and approval

Risk–benefit as Going Out There and the HSE describe it: benefits recorded, a risk matrix, and an approver’s acceptance statement with their name and time
An editable hazard library and standing assessments, reviewed on a cycle, for the visits a school makes every week
Approval stages routed per school, to named officers where the policy says so; delegation, conditions, and deadlines back-scheduled from departure in working days. A recorded decision is never changed

Pupils, families and consent

The roll from the council’s own MIS extract each morning, or a live roll feed where a council runs an endpoint in front of its SEEMiS data
Consent from a holder of parental responsibilities, or from the young person at 16 and over; conditional answers; paper and telephone replies recorded with the recorder named
A family portal with no password to forget — a code sent only to an address the school already holds — and a plain-language briefing for pupils by link or QR code, with no pupil accounts
Reasonable adjustments recorded as actions with an owner, so “not possible” needs a recorded conversation with the family

Staff and safeguarding

A competence register: PVG membership with who confirmed it and when, and first aid and leader awards checked as valid on the day the group returns
Staffing ratios and required roles from the council’s policy, counting pupils with additional support needs
Health information is held against one visit rather than against the child, encrypted, and shown only to the roles one tested access rule allows. Safeguarding incidents are restricted from the moment they are written, and nothing can widen them again

On the day, and on the worst day

Headcounts that cannot be rewritten, one supervision group per pupil enforced by the database, and one-tap updates to families — departed, delayed, back at school
An emergency plan for every visit, kept as revisions so it shows what the plan said that morning; the council’s duty officer arrangement; a declared emergency with a log of who rang whom
Incident narratives that cannot be edited, severity that can only rise, and RIDDOR deadlines tracked to the HSE reference
A Met Office forecast to inform dynamic risk assessment, and an optional, coarse last-known location — off unless the council and the visit leader both turn it on, and seen by council responders only while an emergency is open

Money, providers and insurance

Cost lines, payments from the council’s payment platform, refunds and reconciliation. No child is excluded by cost, and nobody learns who was subsidised who does not need to
One provider directory per council, with insurance and activity licences held as dated evidence, plus transport, accommodation and rooming plans
The council’s insurance policies, whether a visit is covered, when the insurer must be told, and who to ring to claim

Expeditions

Duke of Edinburgh’s Award and John Muir Award expeditions as their own kind of visit: route cards with escape routes, group sizes, supervisors’ awards, and checkpoints whose missed check-ins are noticed

Oversight, records and leaving

Authority-wide reports and a compliance dashboard: what is planned, waiting, happening today and overdue, by school
Optional, anonymous benchmarking between councils that opt in — visits per thousand pupils, incident rates, approval times. No pupil data and no council names
A retention schedule set per record type and mapped to the Keeper’s Model Records Management Plan; subject access and erasure on request; an exit pack of everything the council holds when it leaves

A helper that explains and never decides

“Why can’t this visit go ahead?” is answered finding by finding: what it means in a teacher’s words, whether it comes from the council’s policy or a platform safeguard, and who can fix it. The helper is deterministic and never approves, submits, rates or changes anything. Generative rewording is an optional extra that is off by default; if a council turns it on, every request passes a personal-data redaction gate first, the model must be hosted in the UK or EU, and each attempt is audited.

Built for a phone in a glen with no signal

A trip is exactly where connectivity cannot be assumed, and the people using the system include a supply teacher, a parent on a basic phone and a duty officer at 2am.

Works offline: Staff can take a register, log an incident and reach emergency contacts with no signal. What the phone keeps is encrypted under a key that cannot be exported, and synchronises when a connection returns.
Any device: Installs to a phone’s home screen. iOS and Android apps are prepared from the same code for distribution through a council’s device management; they are not yet in the app stores.
Accessible: Audited automatically against WCAG 2.2 AA on every build, across 87 screens in three presentations and five widths, with no violations at the last run. A manual pass with NVDA and VoiceOver is still to be done.

The frame it is built and audited against

Scottish specifics are modelled rather than bolted on. Listing a framework here means the platform records what it asks for; it is not a claim of certification, and the council remains the duty-holder. Our guide to educational visits in Scotland sets out what each one asks of a council.

Going Out There
OEAP National Guidance
HSE school trips guidance
PVG (Scotland) Act 2007, as amended
Adventure Activities Licensing Regulations 2004
Age of Legal Capacity (Scotland) Act 1991
Children (Scotland) Act 1995
Education (Additional Support for Learning) (Scotland) Act 2004
Equality Act 2010
UNCRC (Incorporation) (Scotland) Act 2024
RIDDOR 2013
Public Records (Scotland) Act 2011
UK GDPR and Data Protection Act 2018
ICO Children’s Code

How it is built

Technical and data protection summary
Separation between councils	One tenant per authority, each on its own address. Row-level security is forced on every council table in PostgreSQL, the application connects as a role that does not own them, and it refuses to start outside development if that is not so. Each council’s policy, data and users are separate; nothing is shared but the platform.
Children’s data	Health and support needs, medication, dietary requirements, consent answers, family and staff contact details, incident narratives and the free text staff write about pupils are encrypted field by field with AES-256-GCM, under keys the database never sees. A pupil’s name and class are not field-encrypted, because registers must be produced and searched from them; they are protected by row-level security, school-scoped access and storage encryption. Uploaded documents are envelope-encrypted and scanned for malware by a scanner we host ourselves.
Audit	Append-only and hash-chained, sealed daily and verified nightly, so a gap or a rewrite is detectable. Viewing restricted material is audited too.
Hosting	United Kingdom — AWS London (eu-west-2), including document storage and backups. Encrypted nightly backups with continuous log archiving.
Sign-in	Secura SSO, with passkeys and multi-factor authentication. Staff accounts are provisioned from Excursions to the council’s own Secura tenant over SCIM 2.0. Families and pupils never have accounts.
Integration	The council’s MIS extract, or a roll endpoint the council runs — we do not connect to SEEMiS ourselves. The Scottish Government’s school contact list (Open Government Licence). The council’s payment platform. GOV.UK Notify for text messages, when the council turns them on. Met Office forecasts, sent a postcode and nothing about a person.
Architecture	One deployable of nineteen domain modules with enforced seams, and no business rules in the browser: what a visit needs and who may approve it are always answered by the server, so the phone cannot disagree with the council’s policy.

Full detail in the trust centre

Where we are

Secura Excursions is in development. It is built, running in our staging environment, and we can demonstrate it to you end to end. It is not used by any council, holds no council’s data, and we hold no contract for it. We built it to production standard against what Scottish authorities publish about how they run visits, not against a signed specification.

Done: Nineteen modules, from policy to emergencies, staged and demonstrable

1,685 automated tests passing at the last build, 12 October 2026

Tenant isolation proven against a real PostgreSQL database

Automated WCAG 2.2 AA audit: no violations across 87 screens

DPIA written in the ICO template, family privacy notice and accessibility statement drafted
Before a council’s data goes in: Close the items our own go-live audit of 12 October 2026 marked as blocking

An external penetration test with no open high or critical findings

A backup restore drill, evidenced within the recovery time

Cyber Essentials Plus, and on-call cover for live visits

The DPIA reviewed and signed by the pilot council’s data protection officer

A manual assistive-technology accessibility pass

A first pilot would start with one council, selected schools, and day and local visits, with residential and overseas visits following once their acceptance tests pass. An early authority partner gets the product at cost, direct influence over what gets built next, and an exit that costs nothing but time. We will share the full go-live audit with any council considering a pilot.

See it working. If you run educational visits for a Scottish authority, we will walk you through a visit from proposal to closure on the staged system, with the engineer who built it. Email info@cairnova.io or call +44 (0)7301 516129.

Questions councils ask

Is Secura Excursions in use by a council today?

No. It is built and staged, and we can demonstrate it, but no council uses it and we hold no contract for it. The list above says what has to happen before any council’s data goes in.

Where is the data held?

In the United Kingdom, in AWS London (eu-west-2), including documents and backups. If a council turns on phone alerts, Apple’s and Google’s delivery services carry a message encrypted end to end to the phone; they see neither its content nor anyone’s name. Text messages are off until the council chooses a provider; we recommend GOV.UK Notify, which is UK-hosted.

Does it work without a mobile signal?

Yes. Registers, headcounts, incidents and emergency contacts work offline on a staff phone, encrypted on the device, and synchronise when a connection returns.

Does it connect to SEEMiS?

Through the council, not directly. The supported route is the council’s own scheduled MIS extract, picked up each morning. Where a council or its MIS partner runs an endpoint in front of its SEEMiS data, the platform can read the roll live from it.

Can we use our own visits procedures?

Yes — that is the point. Approval chains, ratios, required evidence, lead times, visit types and consent questions are the council’s own, set in a versioned policy its administrators publish. Onboarding reads an existing procedures document into a first draft.

Does it use artificial intelligence?

Not by default. The helper that explains why a visit is not ready is deterministic and never decides anything. Optional rewording by a language model is off unless a council turns it on, and then only through a UK or EU endpoint, behind a gate that removes personal data first.

What happens to our data if we leave?

The council’s system administrator can produce an exit pack of everything the council holds, with a strong sign-in required. After that, data is deleted on an agreed schedule, backups included.