For UK schools and MATs · Fail closed · Hosted for the UK

The right adult. Every notice reaches the right adultthe right childnothing else

Pupil Gate is the engagement layer between school and home. One inbox, household-safe delivery, and an office queue that owns the follow-up. Restrictions fail closed. Arbor stays the register.

Open the demo See how it works

Same family as School Rota
Same family as Inclusion Loop
Safety is never an upsell

Blocked · do not contactnow

Alex Taylor is excluded from this letter. Local protective deny. Emergency does not override.

Evaluator · fail closed · office exception open

Delivered to Sam

In-app + email · Lottie only · Jack is a different school

R Riverside Primary

Today

Lottie · Y4Jack · Oakfield

Know and do

Fri

Museum consentComplete the form. This is not legal service.

Due

Now

Snow daySchool closed. Acknowledge when you can.

Inbox

Office queue

Owner, due date, status.

Club kit listWaiting parent · Pat

The problem

School–home tools treat households as one inbox.

Split homes, delegated carers and court restrictions do not fit a class email list. Sending “to all parents” is how the wrong adult sees the wrong child.

Wrong adult

A letter about collection or an address should never reach a prohibited contact, even in an emergency.

Stale MIS

If last night’s import is old, or a restriction field is blank, the product must stop — not guess.

Unowned follow-up

Parent replies die in a shared mailbox. Threads need an owner, a due date and a status.

The product

One place for school and home.

Parents see what they are allowed to see. The office sees who was excluded and why. DSL sees the halt. Nobody else does.

Parent home

Know and do cards, multi-child chips, and a school switcher. Empty states say linking or nothing due — never invent a letter.

Household-safe inbox

Letters, acknowledgements and forms, grant-scoped. Search never reveals another adult’s item.

Office inbox

Structured threads with an owner, due date and status. Replies stay on the monitored office queue.

Restrictions

A 30-second local protective deny. Missing evidence is unknown, not allow. Release is a DSL power.

Invites

School-verified only. GET never consumes a token. Parallel redeem is once.

Emergency

Reserved queue, quiet-hours override, expiry. Restrictions still apply.

How it works

From last night’s import to a letter the right adult can open.

Import

Dry-run the register.

CSV with restriction coverage. Mass change is quarantined. Arbor stays the source of truth.

You never publish a half-import.

Import

CSV with restriction coverage. Mass change is quarantined. Arbor stays the source of truth.

Evaluate

Fail closed, every time.

Read, send and invite share one evaluator. Unknown evidence is not an allow.

Emergency never overrides a deny.

Evaluate

Read, send and invite share one evaluator. Unknown evidence is not an allow.

Invite

GET never activates.

Mail scanners cannot consume a token. Redeem once, after sign-in.

Imported adults stay imported until someone invites.

Invite

Mail scanners cannot consume a token. Redeem once, after sign-in.

Deliver

Per-recipient outcomes.

In-app, email and print. The archive records who was suppressed and why.

Nobody claims “everyone received it”.

Deliver

In-app, email and print. The archive records who was suppressed and why.

Three surfaces, one evaluator

Parent, office and DSL are not the same product.

They share tenancy and grants. They do not share inboxes, threads or halt notes.

ParentKnow and do

Home and inbox

Cards for the children this adult may see. Forms, calendar and office messages stay grant-scoped.

Used by · parents · delegated carers

OfficeQueue and send

Letters and threads

Preview exclusions, send, own the reply. Import, invites and print live here.

Used by · school office · administrators

DSLHalt only

Safeguarding halt

Office copies disappear. Release of a local deny is a DSL power. This is not a case system.

Used by · DSL · deputy

MVP cut

What ships before cases, money or AI.

Parent home

Know and do cards, multi-child chips, and a school switcher. Empty states say linking or nothing due — never invent a letter.

Household-safe inbox

Letters, acknowledgements and forms, grant-scoped. Search never reveals another adult’s item.

Office inbox

Structured threads with an owner, due date and status. Replies stay on the monitored office queue.

Restrictions

A 30-second local protective deny. Missing evidence is unknown, not allow. Release is a DSL power.

Invites

School-verified only. GET never consumes a token. Parallel redeem is once.

Emergency

Reserved queue, quiet-hours override, expiry. Restrictions still apply.

Print packs

Paper-only families stay in the same audience. Packs go stale when access changes.

CSV import

Dry-run, mass-change quarantine, restriction coverage and office exceptions before anything is live.

Change requests

Parents propose email, phone or address. The register updates only after review and source confirm.

Flexible payments

ParentPay, a school-owned Stripe payment link, BACS, or a note that says where to go. We never become merchant of record.

Full feature list

Integrations

CSV now. Arbor later. Never silent write-back.

The register stays in the MIS. Pupil Gate imports, evaluates and engages.

CSV

Dry-run, mass-change quarantine, restriction coverage and office exceptions before commit.

Arbor spike

Connector fields are reserved. Live sync waits for a named owner and a freshness label.

Email console

Signed webhooks, attempt history, unknown until reconciled. Print for paper-only adults.

Integration notes

Trust

Same family as School Rota and Inclusion Loop.

Navy ink, warm paper, UK schools, processor not controller. Safety is never an upsell.

Fail-closed evaluator on every parent read and every send
Production designed for UK residency
Audit rows on restrictions, roles, invites and merge
School Rota and Inclusion Loop use the same visual language

Who it is for

School office first. Parents next. MAT later on the same tenancy.

Teachers who are also parents use one login and switch membership. Full admin stays on the web.

Office staff who own letters, invites and exceptions
DSL and deputy for halt and protective-deny release
Parents and delegated carers, including paper-only families
Trusts that need two schools isolated on one platform

Packaging

Essential first. Plus later.

Restrictions and safeguarding halt sit on every paid tier. Safety is never a SKU.

Essential

Inbox, letters, consent, office threads, restrictions, invites, print packs and CSV import.

Talk to us

Plus / Complete

Cases, gate capture, staff AI assist and Ask School stay behind later gates. Payments are school-owned: their provider, their Stripe, bank transfer, or a link to wherever they already collect.

See packaging

Is this a replacement for Arbor or SIMS?+

No. Pupil Gate is the engagement layer. The school register stays in your MIS. Parent changes are office-reviewed requests, never silent write-back.

What happens if a restriction is missing or stale?+

The evaluator fails closed. Unknown evidence is not an allow. The office sees an exception, and that adult is not invited or mailed until someone reviews it.

Can a mail scanner activate a parent account?+

No. Opening an invite link does nothing. Redemption is an authenticated confirm after sign-in, and a token can be used once.

Do two parents of the same child share an inbox?+

No. Each adult has their own inbox, threads, form answers and change requests. Grants are evaluated per adult and per child.

Does emergency override a protective deny?+

Emergency overrides quiet hours and expiry windows. It never overrides the permission evaluator. A blocked adult stays blocked.

Where is data hosted?+

The product is designed for UK schools. Production residency is the UK. We are the processor; the school is the controller.

Is safeguarding a case system?+

No. Raising a halt restricts office copies to DSL or deputy and leaves a generic stub. It is not a CPOMS replacement.

What is in the first paid tier?+

Essential covers inbox, letters, consent, office threads, restrictions, invites and print packs. Safety features are on every paid tier. Payments, when the school turns them on, use the school's own provider, Stripe account, bank transfer or a link out — Pupil Gate is not the merchant of record.

Contact

Talk to us about a six-week pilot.

Schoolshello@pupilgate.comPilot conversation, not a sales sequence.Securitysecurity@pupilgate.comVulnerability reports. No bounty implied.DemoOpen the productFictional Riverside and Oakfield. Code 246810.

Start with the office queue, not another newsletter.

Import the register, review restrictions, then invite. The evaluator is already live in the demo.

Open the demo Read the cut line

Today at Riverside

Eligible adults4

Suppressed4

Open exceptionsowned