Wonde and GCSEpod

[Steven_Cleaver]

Hi

 

The school is looking at using GCSEpod and to do this we have to have something called Wonde setup on our SIM's Server to do the data extraction they were using Group Call but have moved to Wonde and ourselves and technical team from Wonde are having issues getting this past our Smoothwall we have used Group call in the past and this is fine can't find much about Wonde wondered if anyone had experience of this.

[chinesewhispers]

Sorry to butt in on an indirectly related matter. In a similar situation here, but we'd be using Wonde with hosted Bromcom (so all pieces are cloud based). I'm having issues getting my head around how Wonde uses the MIS data in accordance with Data Protection. Is anyone doing this and happy with the process?

[vikpaw]

@Steven_Cleaver Smoothwall have a support forum here which might be more use.

I'll leave this here in case anyone picks up on Wonde, but we can move it to the dedicated forum if you want and their support can help you out.

[Steven_Cleaver]

Have found a way this for now and altered our Smoothwall just need to test it a bit more.

[chinesewhispers]

Are you happy using Wonde?

[chinesewhispers]

Are you happy using Wonde?

[bobsmith]

We had a load of issues recently with setting up Wonde. The issues were all based around their "grab all the data" extract methodology. Bearing in mind how little GCSEPod should need to setup accounts etc they wanted SIMS permissions that would give them virtually unlimited access.

 

After a lot of back and forth I created a new user group type in SIMS which was as locked down as possible and it's been working fine ever since.

 

GroupCall exporter seems much easier, though that said they've got far more access rights currently than they probably need.

[pete]

So is this just for new customers?

 

Asking because I already have umpteen vendors happily using Groupcall and I'm reluctant to tolerate special snowflakes.

[chinesewhispers]

I've requested a list of what is collected (and stored) by Wonde when they interrogate the system. If you use Wonde, or are considering using Wonde, I suggest you do the same.

[vikpaw]

I spoke to them today - it seems their model is to pull out everything and then as a school, you decide which third party has access. It's not always clear exactly what the third party wants / needs, so there is a new model in the pipeline, whereby they only pull out the data that a specific service requires. If this changes they update the calls. In an April-ish update this control should be passed to the school.

 

I envisage this is going to be a bit like an Android App update, where if it's permissions need altering, then the user (school) will get a message and have to acknowledge and agree.

 

I like the idea that they become your gateway and you don't have to do multiple integrations with multiple partners, but it does mean moving your security perimeter to them. Though with the new selective integration framework this will become less of an issue. I prefer that from a DP point of view.

[chinesewhispers]

I've been having the same discussions, and from a DP point of view, in my opinion, their current model is in breach of their own policy is it not?

 

Either way, I cannot accept to use their system the way it is set up at the moment. If it was a package hosted at our site as an intermediary, which carried out the procedure, it wouldn't matter so much.

 

Interesting to see if the changes incorporate any of the problems with UPN highlighted here: http://www.edugeek.net/forums/security/181342-sharing-upns-externally.html as that's basically a similar discussion now.

[GREED]

GroupCall exporter seems much easier, though that said they've got far more access rights currently than they probably need.

 

Most partners either have or are migrating to Xporter on Demand which directly ask the school what data is and is not being requested by each and every partner integration. School authorises that before any data leaves and partner cannot access anything above this.

 

This also covers the new GDPR requirements coming next year - we are all aware of this right?

[vikpaw]

The current model is that they make all the extracted info available on request, if approved by the school. So to do that they need all the info. [!]

The refinement, which i believe is working right now, is that they restrict what data is pulled out on a partner by partner basis, currently they control this, so changes are manual.

By April when control passes to the school, it will be automated, so more like the GC on-demand service, i guess.

 

I'm looking into GCSE Pod and they favour Wonde, hence my interest in the service. I like the fact that they publish the API for third parties to see.

[GREED]

Have you looked at XoD at all yet @vikpaw ?

[vikpaw]

Not yet but I will be. GC still provide the best SMS service in the Middle East that I've seen.

[Steven_Cleaver]

Just for info Wonde pulls the information every hour from SIM's using Commandlinereporter I did when we were setting this up query the necessity of this being pulled every hour with GCSE Pod and Wonde as I couldn't really see this was necessary so monitored this and it seemed to run ok initially but then seemed to cause some performance issues in SIM's as it was running multiple instances of Commandlinereporter so had so had to contact GCSE pod and Wonde and Wonde found that it was running multiple instances of Commandlinereporter as it was having issues extracting student info and running this again any how this has gone back to developers and I have scheduled the Wonde service to stop during school hours and just run for a few hours overnight to do the extraction.

[ModeratelyGruntled]

Hi

 

Just my two cents on the matter.

 

I've just cancelled a deployment that required the use of Wonde for the DPA reasons listed above.

 

I was planning to use a third party company for setting up and syncing SDS. I didn't realise at the time they used a partner company (Wonde) to actually sync data.

 

Wonde provided plenty of documentation stating they were in accordance with DP policies - but when I actually looked at what their reports were doing I was a little surprised considering we only needed to sync basic student data for class lists. The SIMS user they ask you to set up would have permissions to view/and edit pretty much any data in SIMS (req'd Personnel Officer and SMT roles, among others). It's basically every drop of staff and pupil data possible. It didn't sit comfortably with me at all.

[vikpaw]

It's not just Wonde. I remember it was fairly common for third parties and integration partners to ask for access to very high level permission groups, because they didn't know any better and the permissions framework doesn't come with much out of the box.

[ModeratelyGruntled]

It's not just Wonde. I remember it was fairly common for third parties and integration partners to ask for access to very high level permission groups, because they didn't know any better and the permissions framework doesn't come with much out of the box.

 

Agreed - and for SIMS especially the permissions ladder is more of a tangled web, but you'd expect any third party writing applications to sync data from SIMS to be have a basic understanding of what the roles do. As I say, we were only looking for a class list sync tool. I get that their application has other uses, but it can't be kosha to use only a small section of the data you take?

[GREED]

Ref: GDPR

[vikpaw]

Agreed - and for SIMS especially the permissions ladder is more of a tangled web, but you'd expect any third party writing applications to sync data from SIMS to be have a basic understanding of what the roles do. As I say, we were only looking for a class list sync tool. I get that their application has other uses, but it can't be kosha to use only a small section of the data you take?

You're right. They have now changed the model to accommodate this. From what I understand, their purpose / use of the data is to make it accessible via an API for others to use, so in this sense they are doing what they need, take it all, present it all. Then it's the third party (or is it fourth now?) accessing the API that have to make sure they only take the data they need. With the new model the controls will be more compliant. If in doubt, contact them and ask for the bespoke fit, or check with another integrator. In the case of GCSEPod though, their preferred partner is Wonde, so if you want that, I'd contact Wonde and request the cut down version.

[bobsmith]

After a bit of back and forth I've created a custom SIMS user group for Wonde, it's totally locked down (as much as you can with SIMS) and is still pulling the data they need for GCSEPod

[gh5000]

@bobsmith - can you share the final permissions you settled on. It'll save me a bit of time as I'm going through the same process.

 

I started the "Sharing UPN's externally" thread (http://www.edugeek.net/forums/security/181342-sharing-upns-externally.html#post1561239) with Wonde and GCSEPod in mind - before I knew they took everything. I wasn't even happy that they took UPNs and ULNs as they are unique identifiers. Wonde have been to the DfE and they have come back with the following helpful information

 

please find the feedback from the DFE below:

 

• Sharing data with third parties is not covered by legislation, other than the DPA. The schools as data controllers must therefore abide by this act.

• Best practice within schools is also to have privacy notices and these should set-up the school’s policy on sharing data.

• The treatment of personal data, including the UPN and ULN is covered by the DPA and by any policy or agreement the school initiates as the data controller. There are no specific legal elements allowing or disallowing the extraction or transmission of the ULN or UPN.

[bobsmith]

@ghanel

 

Thirdparty reporting

Students - basic details/registration - view admission number

Staff - basic details/employment details/timetable & academic classes

Reports

Curriculum

[matt40k]

@bobsmith Might be worth exporting and uploading ...