Safe, simple, school-ready

RunPy is designed to be safe by default for pupils aged 11–18, and aligns with the expectations set out in Keeping Children Safe in Education 2025 (in force from 1 September 2025) and the DfE filtering and monitoring standards:

• No student-to-student chat or messaging, no DMs and no peer-to-peer content sharing — removing common vectors for peer-on-peer abuse and harmful sexual behaviour.
• No public profiles, no open user-generated content feed and no external embeds, reducing exposure to harmful or illegal content covered by the Online Safety Act 2023.
• Pupils only see and share work inside classes they have joined via a teacher-issued join code; teachers can revoke access at any time.
• Designated safeguarding leads can enable a school safeguarding dashboard to monitor every comment and code edit a teacher makes to a pupil's account.
• Teachers can remove a pupil from a class or reset their password from the Manage Class screen; account deletion requests are handled within 30 days.
• Account creation requires only a name and email address; we don't collect home addresses, phone numbers, photos or biometric data.
• No generative-AI features, no chatbots and no image generation — pupils cannot use RunPy to produce or encounter AI-generated harmful content, sidestepping the AI and deepfake risks highlighted in recent KCSIE guidance.

• Data is stored on Supabase in the London region (eu-west-2), so it stays in the UK at rest. Supabase is ISO/IEC 27001:2022 certified and SOC 2 Type II audited.
• The web application is hosted by Railway (SOC 2 Type II) in its EU West region (Amsterdam). Requests are processed there but no data is stored there.
• We collect the minimum needed to run a class (name, email, role, school name for teachers).
• Python code runs entirely on the pupil's device via Skulpt; nothing is executed on our servers.
• Self-hosted scripts: RunPy makes no off-domain script requests.
• Strictly necessary cookies only; no analytics, advertising or cross-site tracking.

Full details on the Privacy Policy page.

RunPy targets WCAG 2.2 AA. Specifically:

• Light and dark themes; high-contrast text on both.
• Keyboard-navigable editor and dialog flows.
• Readable code editor font sizes; visible focus rings.
• Plain English copy throughout, no jargon-only error messages.

Spotted something we've missed? Tell us , accessibility fixes are treated as bugs and prioritised.

The site is hosted on Railway and served from a single domain, www.runpy.co.uk. The app also connects to *.supabase.co for sign-in and saving work, so allow both. Scripts are served from our own domain with no third-party CDNs or embedded third-party scripts. Invoices are paid on Stripe's own site (invoice.stripe.com), so whoever pays them needs to be able to reach it.

If your filter or PDNS service is blocking us, please point your IT team at /.well-known/security.txt or email support@runpy.co.uk. We can provide a one-page summary for filter-categorisation submissions on request.

• Zero install, works in any modern browser (Chrome, Firefox, Safari, Edge).
• No browser plug-ins; no exam-mode workarounds needed.
• Teachers create classes, share a join code, and get a class dashboard within a minute.
• School licences give a whole computing department shared usage limits, managed by the Head of Department.