Filtering for Multi-Academy Trusts: One Policy, Many Academies
A trust can buy one filtering system for twenty academies, but it cannot hand the same safeguarding judgement to every one of them. This guide shows how trust boards, central IT teams and academy DSLs share filtering and monitoring without gaps.
It covers who carries the duty, three ways trusts organise the work, how to set phase profiles, how to bring a new academy on board, and what evidence to keep for each academy.
One console for the whole trust, with separate settings for each academy
Our hosted CIPA filter lets the central team see every academy while each one keeps its own category switches and allow and block lists. That fits the trusts whose policy is central and whose exceptions are local.
- A primary academy and a sixth form can run different rules in the same console
- Every academy gets the CIPA preset as a starting point
- Activity reports and a policy record give the board and the DSLs something to read
Filtering and monitoring responsibilities in a multi-academy trust
Keeping Children Safe in Education places the duty on governing bodies and proprietors. In an academy trust that means the trust board. The board can delegate tasks, but it cannot delegate away the accountability.
Trust board
Holds strategic responsibility and needs assurance that every academy meets the standards.
- Approves the trust filtering policy
- Names a trustee with oversight
- Receives the roll-up of annual reviews
Chief executive and central team
Turns the board's policy into one procurement and one set of trust-wide rules.
- Owns the contract with the provider
- Sets the baseline category policy
- Coordinates the annual review timetable
Central IT or managed service
Runs the system, keeps the record of changes and produces reports for each academy.
- Configures profiles per academy and group
- Runs and records technical checks
- Flags concerns to the right DSL quickly
Local governing body
Where the scheme of delegation gives it a safeguarding role, it checks that local practice works.
- Hears the academy's review findings
- Asks how blocked requests are handled
- Links with the named trustee
Headteacher and academy SLT
A named senior leader in each academy makes sure the standards hold on site.
- Requests local changes with reasons
- Leads the local part of the review
- Makes sure staff are trained
Academy DSL
Takes lead responsibility for online safety in the academy and acts on what reports show.
- Reads monitoring reports and alerts
- Knows which pupils are most at risk
- Gives the local governors assurance
The DfE standards accept that these roles may sit inside a wider job in a school, college or trust. What they ask is that it is clear who is accountable and that changes can be made quickly when a risk appears.
Three ways trusts organise web filtering
There is no single correct structure. Trusts tend to land in one of three models, often moving towards more central control as they grow. Each has a different weak spot to watch.
Centralised
One provider, one console and one central team. Academies request changes through a ticket and the central team decides within an agreed time.
Federated
A trust baseline is locked centrally, and each academy has delegated rights to allow or block extra sites for its own groups.
Devolved
Common in young or merging trusts: each academy keeps its own provider and settings, and the trust collects assurance.
Whatever the model, the groups still need separate rules. Our page on staff vs student web filtering policies covers how to keep staff access useful without weakening pupil protection.
Letting academies differ without losing sight of them
Each school in the console has its own always-allow and always-block lists, and a change applies within seconds. The central team still sees every academy's reports and policy record in the same place.
Writing filtering into the trust scheme of delegation
Most trust-level gaps come from tasks nobody wrote down. A short table in the scheme of delegation, or in the trust online safety policy, removes the guesswork. Here is a starting point to adapt.
| Task | Who decides | Who does it | Evidence kept |
|---|---|---|---|
| Approve the trust filtering and monitoring policy | Trust board | Central safeguarding lead drafts | Board minutes and policy version date |
| Choose and contract the filtering provider | Central team | Central IT with DSL input | Procurement notes, provider checklist response, DPIA |
| Set the baseline categories blocked for all pupils | Central team | Central IT | Category list with a reason for each block |
| Allow a site for one academy or year group | Academy SLT | Central IT or academy technician | Change record entry with requester and reason |
| Respond to a monitoring alert | Academy DSL | Academy DSL and pastoral team | Safeguarding record in the academy system |
| Run filtering checks on devices and sites | Shared | Central IT with academy DSL | Check log: date, checker, test, result, action |
| Lead each academy's annual review | Academy SLT | Senior leader, DSL and IT together | Review record per academy |
| Report review findings across the trust | Trust board | Central safeguarding lead | Roll-up summary and action tracker |
One line no trust should delegate: the standards are clear that no one in the school, college or multi-academy trust should be able to disable or change the IWF and police-assessed terrorism blocklists. Make sure console roles reflect that.
Phase profiles: one trust baseline, different rules by age and need
The standards ask for filtering that suits the age and ability of users, and the UK Safer Internet Centre definitions list differentiated filtering as a system feature. In a mixed-phase trust, profiles are where that becomes real. These are example starting points, not recommendations for your pupils.
Ages 4 to 11
Tight by default, with teacher-led access to video and research sites.
- Block Social Networking, Dating, Gaming chat sites
- Enforce safe search
- Allow Education/Reference widely
Ages 11 to 16
Room for research on health, politics and history, with clear blocks on harm.
- Allow News/Media and Political
- Block VPN / Proxy / Anonymizers
- Decide AI / LLM Tools by policy
Ages 16 to 19
Closer to adult study, with independent research and career searches.
- Allow Job Search/Careers
- Review Forums / Message Boards
- Keep Adult and Gambling blocked
Profile by need
Age alone is a poor guide. Profiles often follow the pupil's understanding of risk.
- Simple allow lists for some groups
- Approved assistive tool sites
- Close link to each DSL
Adults at work
Wider access for teaching, still protected from illegal and harmful content.
- Allow Streaming Media for lessons
- Keep Malware / Phishing blocked
- Record changes like any other
For pupils with additional needs, see our page on SEND pupils and web filtering. All 58 category names are listed in the web filtering categories taxonomy.
School-system and sharing domains in our data
When an academy joins, the first exceptions usually name its own management and learning tools. These are the labels our database holds for a few of them.
| Domain | Categories in our data | Likely local exception |
|---|---|---|
| classcharts.com | Education/Reference, Web-based Applications | Behaviour tool one academy already uses |
| bromcom.com | Education/Reference, Web-based Applications | Management information system for staff |
| arbor-education.com | Education/Reference | Another management system |
| seesaw.me | Education/Reference | A learning journal in a primary |
| sharepoint.com | Cloud Storage / File Hosting | Document storage shared across the trust |
| wetransfer.com | Cloud Storage / File Hosting | File sending that a trust may allow only in some places |
Bringing a new academy into the trust's filtering
The weeks around conversion or transfer are when filtering most often slips. Old contracts end, devices change hands and the DSL may be new to trust systems. A simple sequence keeps pupils covered throughout.
Collect what exists
Ask for the current provider, contract end date, last review record, check log and any local allow or block lists.
Map local exceptions
List each site the academy allows or blocks outside the defaults, with the reason. Keep the ones that still make sense.
Plan the switch-over
Avoid a gap between old and new systems. Agree a cut-over date and test both school network and off-site devices.
Apply trust profiles
Move users into the right phase profiles, then add the approved local exceptions as academy-level changes in the change record.
Run first checks
Test illegal content blocking, adult content and safe search on each device type, and record the results.
Brief the DSL and staff
Show the DSL how reports reach them and how to ask for changes. Include filtering in the academy's next staff training.
Off-site devices are a frequent gap during transfer. Our guide to Chromebook 1:1 device filtering covers filtering that follows the device home.
Running the yearly filtering review across every academy
KCSIE and the standards expect a review at least once every academic year, led by a senior leader with the DSL and IT. A trust can coordinate the process, but each academy's pupils and risks still need their own look.
Use the filtering and monitoring annual review checklist as the template for each academy. Reviews are also due after significant changes, such as a new provider or a merger.
What to ask a provider when filtering for a whole trust
Trust procurement often looks only at price per pupil. The questions below test whether a system fits how a multi-site organisation really works. They sit alongside the standard checks on IWF membership and the terrorism list.
| Area | Question to ask | Why it matters for a trust |
|---|---|---|
| Multi-site management | Can one console hold separate academies, with delegated admin rights per academy? | Lets you run a federated model without giving every technician full control. |
| Change audit | Does every policy change record who made it, when and for which group? | The board needs to see local exceptions, not just the baseline. |
| Reporting | Can reports go to each academy's DSL only, with a trust summary for the central team? | Pupil data should reach the people who need it, not every DSL in the trust. |
| Off-site devices | Does filtering follow school devices at home and on trips? | Trusts with 1:1 schemes carry risk well beyond the school gate. |
| Circumvention | How are VPNs, proxies and encrypted DNS handled? | One weak academy network can teach pupils across the trust a workaround. |
| Data retention | How long are logs kept, where, and under what data sharing agreement? | The UK Safer Internet Centre guidance asks schools to understand retention and consider a DPIA. |
| Category coverage | How quickly are new websites categorised, and how are uncategorised sites treated? | Pupils find new sites before old lists catch up. |
| Exit | Can policies and logs be exported if the trust changes provider? | Avoids losing evidence for reviews already done. |
Our appropriate filtering provider checklist explains how to read the published provider responses, and the school web filter RFP checklist helps with tender wording.
How inspection looks at filtering in a trust today
Ofsted inspects academies one by one. The school inspection toolkit for use from September 2026 judges safeguarding as met or not met, and includes whether a school's information systems protect pupils effectively from online harm.
Academy inspections now
Inspectors speak to the academy's leaders and DSL. They will want to see that the people they meet understand the filtering, even when the trust runs it centrally.
Trust records
The toolkit notes that trusts can keep one single central record for all academies, if each academy's details can be shown separately. Filtering evidence works best the same way.
Trust inspection plans
The government has announced plans for trust-level inspection. Reports suggest it would not start before the 2027 to 2028 academic year. Check the current position before planning around it.
Our guide to Ofsted online safety inspection sets out what inspectors look for and the evidence leaders can point to.
How category data and a hosted filter support trust-wide filtering
We supply website category data, and a hosted DNS filter built on it. Website category filtering is one layer. Monitoring, alerts and responses stay with each academy's DSL and the trust's safeguarding process.
We do not supply the IWF list or the police-assessed terrorism list. Those come through filtering providers that meet the membership requirements. See the category database for providers and in-house teams, or the hosted DNS filter, and check how any site is labelled with the domain category checker.
Six filtering gaps that show up in growing trusts
These patterns come up again and again when trusts compare academies for the first time. Each has a simple fix.
The policy says trust, the console says academy
The written policy describes central control, but each academy still has full admin rights.
Align console roles with the scheme of delegation.
DSLs never see reports
Reports go to central IT, who read them as technical data rather than safeguarding signals.
Route academy reports to the academy DSL, with IT copied.
One profile for all ages
The trust bought one setting and applied it to infants and sixth formers alike.
Create phase profiles and review them each year.
Silent local exceptions
Allowed sites pile up over years with no record of who asked or why.
Require a reason for every change and prune at review.
Guest and staff wifi forgotten
Pupil networks are checked, but guest and staff networks carry pupil devices too.
Include every network in the check log. See school guest wifi filtering.
Bypass tools spread across sites
A VPN that works in one academy is shared by pupils who move between academies.
Block circumvention categories trust-wide. See stopping proxy and VPN bypass.
Trust-wide filtering by academy-owned boxes or one hosted service
These are the points trusts compare when they consolidate.
| Trust question | Separate filter in each academy | Hosted CIPA filter |
|---|---|---|
| Seeing every academy together | Logging into several systems | One console, separate settings per academy |
| Adding an academy | New hardware or a new contract | One DNS setting on its router or firewall |
| Staff on trust laptops off site | An agent on each device | A private encrypted link keeps the same rules |
| Bypass tools spreading | Each site keeps its own proxy list | VPN/Proxy/Anonymizers is a category, blocked even with a staff PIN |
| Reports for the DSLs | Different formats from every box | Activity reports, a policy record and a log export |
| Local exceptions | Edited quietly and forgotten | Per-school lists, with PIN bypass logged and reverting by itself |
Multi-academy trust filtering: frequently asked questions
Who is responsible for filtering and monitoring in a multi-academy trust?
In an academy trust the trust is the proprietor, so the trust board holds the strategic responsibility. Day-to-day tasks can be delegated to the central team, local governing bodies and academy leaders, but the delegation should be written down so everyone knows who is accountable.
Does every academy in a trust need its own annual filtering review?
The standards expect provision to be reviewed at least once every academic year, with checks recorded across devices, sites and user groups. A trust can run one coordinated process, but most trusts keep a record per academy so each academy's pupils and risks are covered.
Can a trust use one filtering policy for primary and secondary academies?
A trust can set one baseline, but filtering should be differentiated by age, ability and risk. Most trusts keep a central baseline and apply separate profiles for primary, secondary, sixth form, special schools and staff.
Can the trust change the IWF or terrorism blocklists?
No. The standards say no one in the school, college or multi-academy trust should be able to disable or alter those blocklists. They come through filtering providers. A trust controls the wider category settings around them.
Are multi-academy trusts inspected by Ofsted?
Ofsted currently inspects the individual academies in a trust. The government has announced plans for trust-level inspection, with reports suggesting it would not start before the 2027 to 2028 academic year. Check the current position before planning for it.
Do you monitor pupils for the trust?
No. We supply website category data and a hosted DNS filter. Monitoring and responding to concerns stays with each academy's DSL and the trust's safeguarding process. Our UK filtering and monitoring hub links to the wider guidance.
A quote is based on the number of academies and devices in the trust, and it reaches you within one business day. Trying one academy as a pilot shows the blocks and the reports before any wider switch.
Talk to us about your trust
Tell us how many academies you run, which phases they cover and how filtering is managed today. We will explain where category data or the hosted filter could fit, and where it would not.