Beyond hosting location and certification, a few further questions round out proper due diligence: how often is the system independently penetration-tested, what is the vendor's data breach notification process, and does the school retain the ability to export its full data set on request rather than being dependent on the vendor for access.
Keep a simple checklist through the whole project: data mapped, test import verified, go-live date agreed, old system retained, staff trained, first reports produced and checked. Assign an owner to each item so nothing slips.
None of this means throwing every spreadsheet away. A quick model or a one-off analysis still has its place. The point is that the system of record, the place your live data lives, should not be a shared file that anyone can overwrite. As a trust adds schools, the case for a single, permission-controlled MIS only gets stronger. Start by mapping what each school records today, agree a common structure, then move to a platform that holds all of it in one place.
Certification is the second, compass.education more concrete checkpoint. ISO 27001 is the recognised international standard for information security management, and a vendor holding current certification has had its security controls independently audited against that standard rather than simply asserting they are secure. For any part of a system handling payment data, such as fee billing or canteen top-ups, PCI-DSS Level 1 compliance is the equivalent standard specifically for payment card handling, and it is worth asking whether that certification covers the billing module directly rather than being described only at the level of the parent company.
Use a modular provider as your benchmark. Compass Education offers a wide module range, so you can map each requirement to a named function and see whether a platform covers it natively or relies on bolt-ons. Build a simple scoring grid: list your must-have features down one side, score each provider from one to five, and weight the categories that matter most to your setting. A large primary and a small independent will weight them differently, and that is the point.
Cost and time are where the case lands for most business managers. The hours spent merging workbooks, chasing errors and rebuilding broken sheets are hours not spent on pupils and staff. A modular provider such as Compass Education lets a trust switch on the functions it needs, from attendance to parent payments, and add more as it grows, so central spend tracks the size of the trust rather than jumping in one go.