$0
Total Licensing Cost
12w
Full Rollout
2w
First Protection
16+
Free Learning Tools
Board Resolution Required
Two actions are needed from the board today
1. Approve this IT plan and authorise IT staff to proceed with implementation.

2. Authorise submission of two free EDU account applications — Google Workspace for Education Fundamentals and Microsoft 365 A1 — both of which require a named Acton representative to submit on Acton's behalf. These are the critical-path items: verification takes 1–4 weeks and the device management rollout cannot proceed until they are approved. There is no cost at any stage.
Approve Plan & EDU Applications Full IT Rollout Plan → Tab 02
Why

Three Headline Benefits

What the board is approving and why it matters for this school.

🔒
Safe by Design
Every device is protected by two independent content filtering layers — one at the Acton network level, one on the device itself that follows students home. Social media, gaming, adult content, and bypass tools are blocked regardless of where or how students connect.
Works on any Wi-Fi, any mobile hotspot, any network — not just on campus.
🧭
Supports Free Thinking
The approved toolkit goes well beyond a standard school setup. Students have access to MIT OpenCourseWare, the Internet Archive, Smithsonian Open Access, NASA's full science library, GeoGebra, PhET simulations, Kialo for structured debate, and more — all free, all curated for open inquiry.
Safety controls and intellectual openness are not in conflict — they are designed together here.
💸
Genuinely Free
Google Workspace for Education Fundamentals and Microsoft 365 A1 are both permanently free for verified schools — not time-limited trials. Cloudflare Zero Trust is free for up to 50 users. OPNsense runs on any spare PC. There are no hidden costs at any stage.
All tools confirmed free as of 2025. Reviewed annually by Acton IT Lead.
Timeline

12-Week Implementation Timeline

Acton is not blocked waiting — Phase 2 can begin immediately, before EDU approval.

⚡ Phase 2 (network filtering via OPNsense + Cloudflare) requires zero account approval and can be deployed in Week 2. Acton gains on-campus protection immediately.
Wk 1–2
Phase 1 · Start Immediately
Apply for EDU Accounts & Device Audit
Submit Google Workspace EDU + Microsoft 365 A1 applications. Inventory all devices. Identify any Windows Home edition laptops needing upgrade. Draft AUP.
Wk 2–3
Phase 2 · No Approval Needed
Network Filtering Live
OPNsense + Cloudflare deployed on school network. Student & Staff VLANs active. All devices on school Wi-Fi are protected from Day 1.
Wk 4–8
Phase 3 · Requires EDU Approval
Device Enrollment & Lockdown
Chromebooks enrolled in Google Admin Console. Windows laptops enrolled in Intune. Cloudflare WARP deployed on every device for off-campus filtering.
Wk 7–10
Phase 4
School Accounts & Approved Apps
Student school email accounts issued. Free thinking toolkit pushed to all devices as managed bookmarks. App allowlists enforced.
Wk 10–12
Phase 5
Training, Go-Live & Ongoing Review
Staff trained. AUP distributed and signed. Term-end review cadence established. Remote wipe process documented and tested.
Compliance

Data Privacy & Compliance

Both platforms are compliant by default under their EDU terms — Acton does not need to negotiate separately.

COPPA Compliance Covered
Both Google Workspace for Education Fundamentals and Microsoft 365 A1 include contractual COPPA compliance for students under 13 as part of their EDU terms. Acton acts as the authorising entity on behalf of parents, as permitted under COPPA's school official exception. The AUP (Tab 04) includes the required parental data consent acknowledgement.
FERPA Compliance Covered
Both Google and Microsoft sign FERPA-compliant data processing addenda as part of the EDU accounts. Student data is not used for advertising. Neither platform shares student data with third parties for commercial purposes under the EDU terms. Acton remains the data controller at all times.
📋 Parent Data ConsentThe Acceptable Use Policy (Tab 04) includes a parent/guardian signature block with an explicit COPPA consent checkbox for students under 13. Every student should have a signed AUP on file before being issued a school device or account. The data consent language has been written to satisfy both Google's and Microsoft's EDU terms requirements.
Roles

Roles & Responsibilities

Who owns what — and the continuity risk the board needs to plan for.

RoleResponsibilitiesTime Commitment
IT Lead
1 person required
  • Owns Google Admin Console and Intune dashboards
  • Manages device enrollment and policy updates
  • Reviews Cloudflare Gateway logs weekly
  • Handles app approval requests from teachers
  • Executes remote wipe for lost / stolen devices
2–3 hrs/week rollout
~30 min/week ongoing
Principal / Admin
  • Signs off on Approved App & Website list each term
  • Approves AUP revisions annually
  • Receives monthly summary from IT Lead
~1 hr/term
Teachers
  • Submit app/site requests via Google Form
  • Report filtering issues to IT Lead
  • Enforce physical device policy in class
Ad hoc as needed
⚠ Continuity Risk — For Board AwarenessSmall schools are vulnerable to IT single points of failure. At minimum, two staff members should hold admin credentials for both the Google Admin Console and Microsoft Intune tenants. Login details must be stored securely — a password manager or sealed envelope in the Acton office safe. If the IT Lead leaves without a handover, Acton risks losing access to its own device management infrastructure.
Training

Free Training Resources for IT Staff

All three platforms provide free, self-paced training — no external IT contractor needed.

Google · Chromebook
Google Educator Certification
Free self-paced training covering Admin Console, Classroom, and Chromebook device management. Certification exam included at no cost for EDU accounts.
Microsoft · Windows / Intune
Microsoft Learn for Education
Free modules on Intune for Education, device enrollment, compliance policies, and Defender management. No account needed to start.
Cloudflare
Cloudflare Zero Trust Docs
Plain-language documentation covering Gateway DNS policy setup, WARP deployment, and log analysis. Fully free, no account required.
Overview

Device Management Overview

Two device types, two free management platforms, one shared filtering layer.

Chromebook Management
Google Admin Console
Google Workspace for Education Fundamentals (free · EDU verified)
Built-in ChromeOS device management (no extra MDM needed)
Chrome Browser Cloud Management (free · browser policy)
Cloudflare WARP forced extension (DNS filtering on-device)
Windows Laptop Management
Microsoft Intune for Education
Microsoft 365 A1 for Education (free · EDU verified)
Intune for Education MDM (free · included in A1)
Microsoft Defender (built-in · managed via Intune)
Cloudflare WARP client via Intune (DNS filtering on-device)
⚠ Priority Action — Week 1Apply for Google Workspace for Education Fundamentals and Microsoft 365 A1 simultaneously. Verification takes 1–4 weeks and device enrollment cannot proceed without them. While you wait, Phase 2 (OPNsense + Cloudflare on-campus) can be deployed immediately — no account approval required.
Tech Stack

Free Tech Stack

Six tools. Zero cost. Covers every layer from identity to endpoint to network.

Chromebook MDM & Identity
EDU Free
Google Workspace for Education Fundamentals
Entire Chromebook management in one place. Admin Console handles enrollment, user policy, app pushing, Chrome extension control, and content filtering. Also provides student Gmail, Classroom, Meet, Drive, and Docs.
Windows MDM & App Control
EDU Free
Microsoft 365 A1 + Intune for Education
Free forever for verified schools. Intune enrolls Windows laptops, pushes app restriction policies, blocks unapproved installs, enforces BitLocker, deploys WARP. Includes Defender and free Windows Education upgrade licenses for any Home edition machines.
DNS & Content Filtering · Both Devices
Free ≤50 users
Cloudflare Zero Trust + WARP
Deploy WARP to Chromebooks via Admin Console forced extension and to Windows via Intune. Filters on-device — works at home, on any network. Block categories by toggle: gaming, social media, adult content, proxy bypass. Free for up to 50 users, no query limits.
School Network Firewall & VLANs
Free · Open Source
OPNsense (on any spare PC)
Free open-source firewall. Creates Student and Staff VLANs with separate SSIDs and filtering rules. Forces Cloudflare/NextDNS as upstream DNS so students cannot override it at the device level. First line of defence on campus.
DNS Fallback / Over 50 Users
Free (300k q/mo)
NextDNS
Free tier covers 300,000 queries/month — enough for a small school. Schools preset with one-click category blocking. Set as forced DNS on OPNsense so every on-campus device is filtered even without the WARP client.
Browser Policy · Both Device Types
Free
Chrome Browser Cloud Management
Pushes Chrome browser policy to any device where students sign in with their school Google account — including Windows laptops. Blocks unapproved extensions, enforces SafeSearch, disables Incognito mode. Works in tandem with Cloudflare WARP.

● Windows Defender (built-in, free) managed via Intune · No Apple devices in scope — Mosyle not required

Phases

Rollout Phases

12 weeks from first application to fully managed, policy-enforced fleet.

Phase 1Apply for EDU Accounts & Audit DevicesWeeks 1–2

Verification is the critical path — start immediately. Audit every device while you wait.

Chromebook
  • Apply for Google Workspace for Education Fundamentals Approval: 1–4 weeks
  • List every Chromebook model and ChromeOS version
  • Confirm devices support forced enrollment
Windows
  • Apply for Microsoft 365 A1 for Education Approval: 1–4 weeks
  • List every laptop model, RAM, and Windows version
  • Flag any Windows 10 Home devices — need free upgrade to Education
  • Build Approved App & Website list with teachers and admin
  • Draft Acceptable Use Policy for students and parents
Phase 2Network Filtering — Immediate WinWeeks 2–3

Deploy on-campus filtering now — no EDU approval needed. Every device on school Wi-Fi is protected immediately.

  • Install OPNsense on a spare PC; replace or sit behind existing router
  • Create two Wi-Fi SSIDs: School-Students and School-Staff on separate VLANs
  • Create a free Cloudflare Zero Trust account; configure Gateway DNS policy
  • Block categories: social media, gaming, adult content, streaming, anonymizers
  • Set Cloudflare as upstream DNS for the Student VLAN in OPNsense
  • Staff VLAN gets a more permissive policy — social accessible for admin, gaming still blocked
  • Test from a student device — confirm blocked sites are inaccessible
Phase 3Enroll & Lock Down DevicesWeeks 4–8

Once EDU accounts are approved, enroll every device and push restriction profiles.

Chromebooks
  • Enable forced enrollment in Google Admin Console
  • Disable Developer Mode, Guest Mode, Linux (Crostini)
  • Push allowed Chrome apps and extensions from approved catalog
  • Block Chrome Web Store installs outside approved list
  • Force school Google account sign-in — block personal Gmail
  • Enable SafeSearch & YouTube Restricted Mode
  • Push Cloudflare WARP as a forced Chrome extension
Windows Laptops
  • Upgrade any Windows 10 Home devices to Education (free via A1)
  • Enroll devices into Intune via enrollment package
  • Push compliance policy: BitLocker on, screen lock, auto-updates
  • Configure App Control policy — approved list only, no sideloading
  • Block install from Store or web for student accounts
  • Deploy Cloudflare WARP via Intune Win32 app deployment
  • Block USB storage via Intune device configuration profile
Phase 4Deploy Approved Apps & School AccountsWeeks 7–10

Issue school identities to every student and push the approved app set — including the full free-thinking toolkit.

Chromebooks
  • Create student Google accounts in Workspace Admin
  • Push Google Classroom, Meet, Drive — configure for school use
  • Set homepage to Google Classroom via Admin Console
  • Configure managed bookmarks for all approved sites and toolkit tools
Windows Laptops
  • Deploy Microsoft 365 web apps via Intune
  • Push Chrome via Intune and enforce school Google account sign-in
  • Block Microsoft Store on student devices via Intune policy
  • Push Chrome Browser Cloud Management policy
  • Whitelist all free-thinking toolkit domains in Cloudflare Gateway (see Tab 03)
  • Test complete student experience on one of each device type before full rollout
  • Set up a Google Form for teacher app approval requests
Phase 5Training, Monitoring & MaintenanceWeeks 10–12

Go live, train staff, and establish the lightweight process that keeps everything working term after term.

  • 30-minute staff session covering Google Admin Console and Intune dashboards
  • Distribute student and parent AUP + "what's blocked and why" plain-language handout
  • Review Cloudflare Gateway logs weekly for bypass attempts or accidentally blocked tools
  • Schedule term-end policy review — update allow/block lists as curriculum evolves
  • Document and test remote wipe workflow for both Admin Console and Intune
  • Create runbook: what to do when a device is lost, stolen, or a student leaves
Policy

App & Content Policy Matrix

What is allowed, blocked, and managed — and which free tool enforces each rule.

CategoryEnforced ByChromebooksWindowsStaff
Google Classroom / Meet / DriveGoogle Admin Consolefree EDU accountAllowedAllowedAllowed
Microsoft 365 Web AppsIntune / browser policyfree M365 A1AllowedAllowedAllowed
Free Thinking Toolkit ToolsCloudflare allowlistmanually whitelisted — see Tab 03AllowedAllowedAllowed
YouTube (EDU channels only)YouTube Restricted ModeAdmin Console policyRestrictedRestrictedAllowed
Social MediaCloudflare category blockBlockedBlockedBlocked
Gaming & StreamingCloudflare category blockBlockedBlockedBlocked
VPN / Proxy Bypass ToolsCloudflare + MDM policyBlockedBlockedBlocked
Chrome ExtensionsAdmin Console / browser policyAllowlistAllowlistManaged
App Installs (Desktop / Store)Intune App ControlN/A · web onlyBlockedIT Approved
Incognito / InPrivate ModeBrowser managed policyBlockedBlockedManaged
USB / External StorageIntune / Admin ConsoleBlockedBlockedManaged
Personal Google / MS AccountsMDM + browser managed policyBlockedBlockedManaged
Developer Mode (ChromeOS)Admin Console device policyBlockedN/ABlocked
Risks

Risk Register

Known failure points and their free mitigations.

EDU verification delays push back MDM setupHighApply Week 1. Meanwhile Phase 2 (OPNsense + Cloudflare) requires zero account approval — deploy immediately for on-campus coverage
Student bypasses WARP via personal hotspotHighIntune blocks "Internet Connection Sharing" on Windows. Admin Console disables hotspot on ChromeOS. Physical policy: phones away during school hours
Windows laptop running Home edition — Intune won't enrollHighM365 A1 includes free Windows Education upgrade licenses. Upgrade affected machines before enrolling — still $0
Student Powerwashes Chromebook to remove enrollmentMediumEnable "Forced Re-enrollment" in Admin Console — Chromebook auto re-enrolls after any Powerwash using Acton's domain
Cloudflare Gateway blocks legitimate free-thinking toolsMediumUse the whitelist table in Tab 03. Test every domain before go-live. Exceptions take under 5 minutes to add in the Cloudflare dashboard
Teacher blocked from a legitimate website or resourceMediumStaff VLAN has a separate, more permissive Cloudflare policy. Individual site exceptions take <5 minutes to add
BYOD device brought by student, not under MDMMediumBYOD connects to Student VLAN — DNS filtered at router. School resources only accessible via school Google account which carries its own restrictions
No spare PC available for OPNsenseMediumSet NextDNS directly as DNS on the existing router. Loses VLAN separation but still filters all on-campus traffic
NextDNS free tier query limit reachedLowUse Cloudflare Zero Trust as primary (unlimited for ≤50 users). NextDNS only needed if school exceeds 50 users
Checklist

Go-Live Checklist

Everything that must be confirmed before opening to students.

Chromebook
Google Workspace EDU account approved
Forced enrollment enabled in Admin Console
Developer Mode & Guest Mode disabled
App & extension allowlist pushed
Cloudflare WARP forced extension deployed
SafeSearch & YouTube Restricted Mode on
Student Google accounts created & tested
Personal account sign-in blocked
Windows Laptops
Microsoft 365 A1 tenant approved
Home edition laptops upgraded to Education
All laptops enrolled in Intune
BitLocker enabled on all devices
App Control policy active (allowlist only)
Cloudflare WARP deployed via Intune
USB storage blocked
Microsoft Store blocked on student devices
Both Device Types + Free Thinking Toolkit
OPNsense routing Student & Staff VLANs
Cloudflare Gateway DNS policy live
Social media & gaming categories blocked
Incognito / InPrivate mode disabled
All toolkit domains tested & accessible
archive.org & wikipedia.org whitelisted
YouTube allowed with Restricted Mode only
Toolkit bookmarks pushed to all devices
Canva for Education EDU verified
AUP signed by students & parents
Staff trained on Admin Console + Intune
Remote wipe tested on one device each type
App request process documented & shared
Term-end policy review scheduled
Philosophy

Three Guiding Principles

The tools are only half the story. The philosophy determines how they're used.

01
Curiosity Over Curriculum
Tools that let students follow a question wherever it leads — not just complete a task someone else set for them.
02
Making Over Consuming
Platforms where the student produces something real — code, music, argument, design — rather than passively receiving information.
03
Go to the Source
The world's primary archives and libraries — unrestricted — so students can verify anything for themselves rather than accepting a summary.
🗺
Student-Led Inquiry
Start with a question the student genuinely has. Use Khan Academy for foundations, PhET or GeoGebra to experiment, Kialo to structure arguments, Canva to present findings. The teacher guides — the student drives.
🔬
Question the Source
For any claim in any lesson, find the primary source on Archive.org, Smithsonian, or NASA. Read the original document. Teach students that knowledge has authors — and authors can be questioned.
🛠
Make Something Real
End every unit with a student-created artefact: a Scratch simulation, a Kialo debate map, a Canva zine, a Flip documentary, a Tinkercad model. Creating forces understanding in a way that testing never does.
Critical Thinking

Argument, Reasoning & Philosophy

Tools that teach students to construct, challenge, and evaluate ideas — not just accept them.

Kialo Edu
EDU FreeWeb
Structured argument-mapping platform. Students build visual debate trees — every claim must be supported, every counter-argument addressed. Used for debates, essay planning, and Socratic discussion.
Forces students to hold their own arguments to scrutiny, not just assert opinions.
kialo-edu.com · Free for all educators
Socratic by Google
FreeApp
Rather than giving answers, Socratic breaks down how to approach a question — showing multiple explanation methods, related concepts, and video lessons. Encourages process over answer-hunting.
Models the Socratic method — understanding why, not just what.
socratic.org · Free iOS & Android
Philosophy for Children (P4C)
Free
SAPERE publishes free inquiry-based lesson plans and community-of-inquiry facilitation guides. Structured philosophical discussion around picture books, dilemmas, and open questions for all ages.
Develops the habit of questioning assumptions at every level — including the teacher's.
sapere.org.uk/resources · Free downloads
TED-Ed
FreeWeb
Short animated lessons on almost every topic — philosophy, science, history, art, ethics. Teachers build custom lesson sequences with discussion questions and quizzes around any video.
Exposes students to perspectives and questions far outside any standard curriculum.
ed.ted.com · Free with school Google account
Self-Directed

Self-Directed & Mastery Learning

Platforms where the student controls the pace, depth, and direction of their own learning.

Khan Academy
Free
Completely free mastery-based learning across maths, sciences, humanities, and computing. Students advance only when they demonstrate understanding. Teacher dashboard shows exactly where each student is.
Mastery model respects each learner's pace — removes the pressure of artificial grade-level lockstep.
khanacademy.org · Fully free forever
CK-12
Free
Free, customisable digital textbooks that teachers and students can edit, rearrange, and annotate. Covers all core subjects. Excellent for mixed-age groups where students are at different levels.
The textbook isn't fixed — students and teachers can challenge, annotate, and rewrite it.
ck12.org · Free, no account required
MIT OpenCourseWare
Free
Every MIT course — lectures, problem sets, exams — published freely online. Older students can pursue genuine university-level material in any field at their own pace. No enrolment, no deadline, no gatekeeping.
Removes the idea that advanced knowledge is reserved for "the right age" or the right institution.
ocw.mit.edu · Fully free, no account
Coursera (Audit Mode)
Free to Audit
Thousands of university courses from Yale, Stanford, and Johns Hopkins audited completely free — all video lectures, readings, and exercises without the certificate. Ideal for motivated older students.
Lets students study exactly what they're passionate about, at university depth, right now.
coursera.org · Choose "Audit" on any course
Creative Making

Creative Expression & Making

Platforms where students produce — writing, music, design, video — not just consume.

Canva for Education
EDU Free
Full Canva Pro feature set free forever for K–12 schools. Posters, presentations, infographics, zines, videos, websites, whiteboards. Collaborative editing. Requires school EDU verification.
Students communicate ideas in their own visual language, not just written essays.
canva.com/education · Free with EDU verification
Chrome Music Lab
Free · No Account
Browser-based musical experiments — spectrogram, rhythm maker, melody maker, chord explorer. Works instantly on any Chromebook or browser. No login needed.
Shows music as patterns, physics, and mathematics — breaks down arbitrary subject boundaries.
Flip (by Microsoft)
Free
Students record short video responses to prompts and share with the class. Great for student-led presentations, documentary projects, and video essays. Integrates with Microsoft 365 A1 — already in your stack.
Gives students a voice format beyond writing — vital for different kinds of thinkers.
info.flip.com · Free with M365 EDU account
Google Arts & Culture
Free
High-resolution access to over 2,000 museums and cultural institutions worldwide. Virtual tours, zoomable artworks, curated collections. No account needed for browsing.
Removes geography and economic barriers to the world's cultural heritage — every student gets the same access.
artsandculture.google.com · Fully free
Coding & Making

Coding, Logic & Tinkering

Build real things. Break them. Figure out why. Repeat.

Scratch (MIT)
Free
MIT's visual programming language for ages 8–16. Students build games, animations, simulations, and interactive stories. Massive public gallery of community projects to remix. Offline version works on Chromebooks and Windows.
Making something from nothing that actually works is one of the most confidence-building experiences in education.
scratch.mit.edu · Free, no account to explore
Tinkercad
Free
Browser-based 3D design, electronics simulation, and basic coding from Autodesk. Students design objects, simulate circuits, and export designs. Runs in Chrome on any device — no install needed.
Bridges the digital and physical — students see how ideas become real objects.
tinkercad.com · Free account
GeoGebra
Free
Interactive maths — graphing, geometry, algebra, calculus, statistics, and 3D visualisation. Students manipulate mathematical objects to see relationships, not just solve equations. From age 10 through university.
Transforms abstract maths from rules to memorise into patterns to discover.
geogebra.org · Fully free, no account needed
PhET Simulations (CU Boulder)
Free · No Account
150+ science simulations from quantum mechanics to pH balance. Students form hypotheses, run experiments, observe results. Works offline on Chromebooks and Windows.
Students do science by exploring, not by following a procedure to a predetermined answer.
phet.colorado.edu · Fully free, downloadable
Open Knowledge

Open Libraries & Primary Sources

Teach students to go to the source — to read the original, not a summary of a summary.

Internet Archive
Free
The world's largest digital library — books, films, audio, software, and the Wayback Machine. Millions of out-of-copyright books readable for free. Invaluable for primary source research.
Trains students to seek primary sources rather than relying on second-hand accounts.
archive.org · Free, no account for reading
Project Gutenberg
Free
Over 70,000 free eBooks — classic literature, philosophy, science texts, and history. Every book whose copyright has expired, freely readable in the browser on any device.
Students read Plato, Thoreau, Mary Wollstonecraft, or Darwin in the original — not excerpts chosen by a textbook editor.
gutenberg.org · Fully free
Smithsonian Open Access
Free
Over 4.7 million images, 3D models, and datasets from the Smithsonian's 19 museums — completely free to use, download, and share. Natural history, art, science, and cultural artefacts at high resolution.
Gives students the same materials professional researchers use.
si.edu/openaccess · Free, no account
NASA Image & Science Library
Free
NASA's entire public image, video, and audio library. Plus NASA Eyes — a free interactive 3D solar system explorer. Real spacecraft data, real mission photographs, real science simulations.
Connects curiosity about the cosmos directly to actual data — no intermediary required.
images.nasa.gov · Public domain, free
Whitelist

Cloudflare Gateway Whitelist

Add these to your DNS allowlist to ensure the toolkit isn't accidentally blocked by category filters.

IT Configuration Note
The Tension Worth Naming: Controlled Devices, Open Minds
Your Cloudflare Gateway blocks categories broadly — and that's correct for safety. But an over-aggressive filter will accidentally block the very tools that support free inquiry. YouTube must be allowed with Restricted Mode on (not blocked outright) because TED-Ed, Khan Academy, and Crash Course live there. Wikipedia must be explicitly whitelisted — it may trigger "user-generated content" filters. Archive.org must be allowed — it's frequently caught by overly broad content filters. Verify every domain below before go-live.
DomainToolBlock RiskAction
youtube.comTED-Ed, Khan Academy, Crash CourseHigh — blocked by "Streaming" categoryAllow + Restrict Mode
archive.orgInternet ArchiveHigh — frequently caught by content filtersExplicitly Allow
wikipedia.orgWikipediaMedium — user-generated content categoryExplicitly Allow
kialo-edu.comKialo EduMedium — debate / social platformExplicitly Allow
khanacademy.orgKhan AcademyLow — well-known EDU domainVerify Accessible
scratch.mit.eduScratchLow — MIT domainVerify Accessible
phet.colorado.eduPhET SimulationsLow — university domainVerify Accessible
tinkercad.comTinkercadLow — Autodesk domainVerify Accessible
coursera.orgCourseraLow — known EDU platformVerify Accessible
gutenberg.orgProject GutenbergLowVerify Accessible
artsandculture.google.comGoogle Arts & CultureLow — Google subdomainVerify Accessible
musiclab.chromeexperiments.comChrome Music LabLowVerify Accessible
ocw.mit.eduMIT OpenCourseWareLow — MIT domainVerify Accessible
geogebra.orgGeoGebraLowVerify Accessible
si.eduSmithsonian Open AccessLow — government domainVerify Accessible
images.nasa.govNASA LibraryLow — government domainVerify Accessible

Acton-issued devices and accounts are provided to support learning. This policy exists to protect students, staff, and Acton School — not to restrict curiosity or punish honest mistakes. Students are expected to use technology as a tool for discovery, creation, and communication. This document explains what that means in practice, what data Acton collects, and what rights students and parents hold.

1

Scope of This Policy

  • 1.1This policy applies to all school-issued devices (Chromebooks and Windows laptops), all use of the school Wi-Fi network, and all activity conducted using a school-issued Google or Microsoft account — whether on school premises or at home.
  • 1.2This policy applies to all students, staff, and visitors who use school technology resources in any capacity.
  • 1.3Personal devices connected to school Wi-Fi are subject to the network use provisions (Sections 3 and 4) but not the device care provisions.
2

Permitted and Prohibited Uses

Permitted Uses
Educational activities, research, and self-directed learning using approved tools
Communication with teachers and classmates using school email or Google Meet
Creative work: writing, design, coding, music, and video using approved platforms
Accessing Archive.org, Project Gutenberg, Smithsonian, NASA, and open knowledge resources
Reporting a technical problem or a filtering issue to the IT Lead
Asking a teacher to request access to a tool or site not currently on the approved list
Prohibited Uses
Attempting to bypass, disable, or remove content filtering software (Cloudflare WARP, DNS restrictions)
Using a personal VPN, proxy, or mobile hotspot to circumvent school filtering on a school device
Accessing social media, gaming platforms, or streaming services on school devices or school Wi-Fi
Signing into personal Google, Microsoft, or other accounts on a school-issued device
Sharing, storing, or transmitting another person's personal information without consent
Any activity that is illegal, harassing, threatening, or that could harm another person
  • 2.1The Approved App & Website List is maintained by the IT Lead and reviewed each term. Teachers may request additions at any time. Students may ask their teacher to submit a request on their behalf.
  • 2.2Filtering is not intended to prevent access to legitimate knowledge. If a student or teacher finds that an educational resource is blocked in error, they should report it to the IT Lead, who will review and unblock within 24 hours if appropriate.
3

Device Care & Physical Use

  • 3.1School devices must be treated with reasonable care. Students are responsible for damage caused by misuse or negligence. Accidental damage should be reported immediately — unreported damage discovered later may result in greater consequences than the incident itself.
  • 3.2Lost or stolen devices must be reported to the Acton office immediately. Acton retains the right to remotely lock or wipe any school-issued device at any time, including when it is at home. Students should not store personal files on school devices for this reason.
  • 3.3Students must not attempt to remove, disable, or modify the device management software (Google Admin Console enrollment on Chromebooks; Microsoft Intune on Windows laptops). This is treated as a serious breach of this policy.
  • 3.4USB storage devices are blocked on student devices as a data security measure. If a student needs to transfer a file, they should use school Google Drive or ask a teacher for assistance.
4

Monitoring & Privacy

  • 4.1Acton uses Cloudflare Zero Trust to filter DNS requests on all Acton devices. This means Acton can see which website domains were requested and whether they were allowed or blocked. Acton does not monitor the content of websites visited — only the domain names requested.
  • 4.2School email accounts are not monitored for content as a matter of routine. However, Acton reserves the right to access communications on school accounts in response to a specific safeguarding concern, with appropriate authorisation.
  • 4.3Students should have no expectation of privacy when using school-issued devices or school accounts. School devices are school property and may be inspected at any time for legitimate reasons.
  • 4.4Monitoring is used to protect students, not to surveil them. Log data is reviewed weekly by the IT Lead for security purposes only and is not shared with third parties except where required by law or a safeguarding obligation.
5

Data Privacy & Consent

6

Consequences of Misuse

  • 6.1Breaches will be addressed proportionately. Acton distinguishes between exploratory mistakes (accidentally encountering blocked content) and deliberate circumvention (installing a VPN, removing MDM software). Only the latter is treated as a serious breach.
  • 6.2Serious breaches may result in temporary or permanent loss of device access, parental notification, and where required by law, referral to appropriate authorities.
  • 6.3Acton will always seek to understand context before applying consequences. A student who reports a problem honestly will be treated more favourably than one whose behaviour is discovered through monitoring.
📋 Staff Version NoteA separate Staff AUP addendum should be completed by all staff who use school devices or accounts. Staff have slightly broader permissions (social media accessible on staff VLAN, IT-approved app installs) but the same monitoring and data provisions apply. Staff addendum available from the Acton office.
7

Agreement & Consent

By signing below, the student and parent/guardian confirm that they have read and understood this Acceptable Use Policy, consent to the creation and use of a school-issued Google Workspace account for the student named, acknowledge the data privacy provisions of Section 5 including the COPPA school official consent for students under 13, and agree to the terms of use outlined in this document.

Student Full Name
Student Date of Birth
Year / Class Group
Date
Student Signature
Signature Date
Parent / Guardian — Required if Student is Under 18
Parent / Guardian Full Name
Relationship to Student
Parent / Guardian Signature
Date
Contact Email (for data access requests)
I have read Section 5 and consent to the data privacy provisions, including COPPA school official consent for students under 13
I confirm I have read and agree to the data privacy provisions of this policy