Vendor assessment information for school and Department review
1. General company information
Company name: EduSwap Pty Ltd.
ABN: 20997890653.
Primary contact: Evan Kill, Director.
Support contact: support@eduswap.com.au.
EduSwap is a school-to-school platform designed to support the sale, swap, donation, rental and leasing of unused school equipment.
Registered address and insurance certificates may be provided through formal vendor onboarding or due diligence processes where appropriate.
2. Data classification and storage
EduSwap is intended to collect only limited staff-related information required to operate the platform, such as name, school email and school association.
EduSwap is not intended to collect or store student data.
The platform is designed around relatively low-sensitivity staff and school operational data rather than special-category or student records.
Core production data is intended to remain stored in Australian data centres using encrypted storage and transport protections.
3. Privacy and legal compliance
EduSwap’s privacy approach is intended to align with Australian Privacy Principles and related state-based privacy expectations where relevant to school use.
Data minimisation and purpose limitation are intended design principles.
Personal information is not intended to be shared externally except where needed for authorised service delivery, compliance, safety or legal reasons.
EduSwap intends to support Notifiable Data Breaches obligations where applicable.
4. Authentication and access controls
User authentication is intended to support email/password access with optional single sign-on pathways where available.
Administrative access is intended to require stronger controls, including multi-factor authentication.
Role-based access control and school-linked tenancy separation are intended to restrict access to appropriate users only.
Least-privilege access principles are intended to apply to both platform administration and system-level operations.
5. Security controls
EduSwap’s security approach is intended to draw on recognised control frameworks such as ISO 27001, OWASP guidance and NIST-style practices where appropriate.
Security review processes may include dependency scanning, vulnerability review, logging, monitoring and periodic penetration testing or pre-release assessment.
Control alignment does not imply formal certification unless expressly stated.
Detailed control areas are summarised in the Cybersecurity Controls Matrix and Security & Infrastructure Statement.
6. Business continuity and disaster recovery
Backups are intended to be encrypted, retained within Australia and managed through controlled lifecycle processes.
Operational recovery objectives are intended to support timely restoration following major incidents, with indicative targets such as recovery time under 2 hours and recovery point under 1 hour where reasonably achievable.
EduSwap maintains operational planning for failover, restoration and recovery activities suitable to the platform’s scale and risk profile.
7. Incident and breach response
EduSwap’s incident response model is intended to support identification, containment, recovery and review of significant incidents.
Notification pathways may include affected schools, Departments of Education and regulators where required by law or risk circumstances.
Post-incident review and root-cause analysis may be undertaken following significant issues.
8. Content moderation and safety
EduSwap uses moderation and safety controls intended to reduce unsafe listings, prohibited content and misuse of the platform.
This may include automated screening, user reporting pathways, manual review and tiered escalation for higher-risk matters.
Urgent safety concerns are intended to be prioritised for faster review where reasonably practicable.
9. Third-party and supply chain risk
EduSwap uses a limited number of third-party providers for hosting, email delivery, identity support and payments.
Third-party providers are selected with regard to security posture, operational suitability and data handling expectations.
Payment card data is intended to be handled by payment processors rather than stored directly by EduSwap.
API keys, service credentials and permissions are intended to be restricted according to least-privilege principles.
10. Accessibility
EduSwap is designed with the goal of aligning with WCAG 2.1 Level AA principles.
The platform’s accessibility approach considers screen reader support, keyboard navigation, contrast, semantic structure and ongoing accessibility review.
An Accessibility Statement is maintained as part of the platform’s broader policy framework.
11. Operational maturity
EduSwap maintains core operational policy documents covering privacy, security, acceptable use, moderation, incident response and related governance areas.
Audit logging, policy updates and continuous improvement are intended to support vendor readiness and school trust.
Operational maturity is expected to continue developing as the platform evolves and school-sector requirements become more formalised.
12. Insurance
EduSwap may maintain business insurance arrangements such as public liability, cyber liability and professional indemnity cover as appropriate to the platform and its operating environment.
Evidence of insurance may be provided during formal due diligence or onboarding where required.