Any vendor claiming ISO 27001 or PCI-DSS Level 1 certification, Compass Education included, should be able to produce current, dated certification evidence on request rather than a general assurance statement. A useful due diligence exercise is to ask every vendor on a shortlist for that evidence side by side. A vendor that can produce an up-to-date certificate on request has clearly built the audit process into how it runs the business; one that cannot has usually not been through that audit at all.

None of these five questions guarantees a good outcome on their own, but a vendor unwilling or  [[https://edrolo.com.au/blog-posts/compass-education-and-edrolo-integration-to-simplify-teaching-and-learning|Pulse]] unable to answer any of them plainly before a contract is signed is worth treating as a warning sign, whatever the rest of the proposal looks like.

Start with the support model. Ask specifically whether support is UK-based, what hours it operates, and what the guaranteed response time is for a genuine outage versus a routine query. A vendor's answer here should be specific and contractual, not a general assurance about "excellent customer service," which means little without a defined service level attached to it.

Beyond hosting location and certification, a few further questions round out proper due diligence: how often is the system independently penetration-tested, what is the vendor's data breach notification process, and does the school retain the ability to export its full data set on request rather than being dependent on the vendor for access.

Finally, look past the launch. An MIS is a multi-year commitment, so weigh the roadmap, the support model and the cost of adding modules later. The right checklist turns a subjective sales process into a decision you can defend to governors and business managers alike. Score honestly, keep your notes, and let the totals guide the shortlist rather than the slickest presentation.

Support deserves its own line. Clarify what is included as standard, what a premium tier costs, the response times you can expect and where the support team is based. When a system is central to daily admin, slow or costly support is a real expense measured in staff time, even if it never appears on an invoice.