Technical FAQs for LGfL-Senso pupil monitoring

We really value the role of technical colleagues and partners in installing and configuring the Senso software and supporting staff. The following Q&A includes vital information to ensure that the software is installed correctly and capturing safeguarding concerns.

Do take a look at the extensive Senso Knowledgebase too, to help with all deployment and set up queries: support.senso.cloud

Please pay particular attention that:

Student users are in the 'Students (monitored)' group - Or they will not be logging!
All devices are visible - If not the installations may have failed
Avoid monitoring staff devices - the is information on all these points below.

ATTENTION CHROMEBOOK SCHOOLS!

If a Chromebook has no storage space, it will ignore commands to install extensions so pay particular attention to the testing information below.

Deployment and Configuration

How do you deploy the software?

Once a school has been confirmed as eligible for the service and representatives have completed both the technical and DSL training webinars, an email will be sent to the technical contact stated on the onboarding form. It will notify you that your school’s portal has been set up and is ready to be accessed and will also include links to installers for different operating systems, with options for Windows (InTune, SCCM, Group Policy), Chromebook, Mac, iOS and Microsoft Teams (extra Teams licence required for those using the unmanaged service).

Is the deployment different for managed and unmanaged?

No, the software installation process is identical. Schools can move between managed and unmanaged with ease (it is simply a question of whether the managed service (human review) team have access to the captures or not). The only difference is that the managed service has a human review team which check, triage and escalate captures whereas captures in the unmanaged service are only seen by the school.

Should it be rolled out to all devices?

Yes. It is really important that there are no devices in school which are not monitored (unless you know a device is in a staff-only area, for example, so will never be accessed by a student). This would undermine the system and the school would be at major risk of serious incidents going unchecked. That is why our unmanaged monitoring service has a per-school licence and you can install it on as many devices as you have. The managed service will be priced per pupil, but again, the number of devices is irrelevant, so you will not be charged more for having 100% device coverage on the monitoring service.

Operating system limitations

Chromebook - the minimum Chrome OS version is 116; please note that the extension is not compatible with Managed Guest Sessions - users must be part of the same Google Workspace tenant and have a managed license.
Windows - Windows 10 will continue to function until October 2025 when it goes end of life; after this it will be Windows 11.
iOS - the iPad app will work for iOS 13+.

What about devices used by staff as well as pupils - how do I exclude staff?

Be aware that monitoring staff is not a matter for safeguarding leads to deal with (headteachers are responsible for managing staff allegations) and must never take place without a headteacher making a conscious decision to do so, this being clearly communicated to all staff and with clear internal processes established for how captures should be handled). Schools may decide to monitor staff devices but please make sure they do so consciously, with Headteacher permission and clear communication with staff (NB - for the managed service, this incurs an extra charge as the service is per user monitored).

Most schools will not want to monitor staff. To avoid doing this (be aware that these steps are not foolproof, e.g. if a device or login is shared or if a user forgets to log out):

Do not install the software on any device which can definitely never be accessed by pupils (eg in the staffroom or office).
For Chromebooks, Senso is rolled out as a Chrome extension which is applied to specific OUs (organisational units). Therefore, only apply the extension to pupil OUs.
For Windows, you have multiple options to exclude staff. These include, for example, excluding any captures from a machine in an AD group which includes the word %staff% or similar. Find out more about groups in the Senso KB.

How will it identify pupils where schools have class logins?

The user name with which the device was logged in is displayed alongside any captures - this is how schools can see who triggered the alert. The DfE Standards for filtering and monitoring state that schools should ensure “users are identifiable [...] so concerns can be traced back to an individual". Therefore, we recommend that schools use per-user logins as this will ensure effective filtering and monitoring. Without this, you could use a method such as numbered devices and a log of which pupil uses which device at a given time, but this may inhibit an effective safeguarding response. The same applies for webfiltering with SchoolProtect, so we recommend this as an opportunity to roll out class logins via your preferred directory system (AD, Entra, Chromebook, etc).

Are firewall changes needed?

No, we have ensured that all LGfL firewalls are ready to go and Senso will work out of the box for all our schools. You do not need to request firewall changes.

Do I need to roll out decryption?

No. Decryption (also known as HTTPS inspection) is essential for getting the best out of your SchoolProtect web filtering system. However, the monitoring software works in a different way on a device level and therefore does not need this step upon initial install. Other Senso modules may require decryption, but not for the monitoring modules.

Will there be conflicts with Sophos?

No. We have tested this and are monitoring closely to spot any technical changes which could cause issues. You do not need to add exceptions for Sophos as this will be done by default.

Can I exclude certain software from being monitored?

Yes. You will be shown how to do this during training. A good example might be your safeguarding concern logging system, e.g. myConcern or CPOMS, where it would be inappropriate to monitor the content and you would also end up in a cycle of captures generating other captures. Full details are shown in the KB.

Disabling Suggested Searches (Autocomplete) in Google Chrome

Google can sometimes suggest inappropriate searches when pupils start typing. To keep them safe by not suggesting potentially unhelpful searches, and also to avoid captures in Senso of searches they never made but which appear on screen, it is best to simply disable autocomplete. To find out the different ways to do this, follow the instructions in the Senso guide.

Are there best-practice defaults?

Yes - these will be applied from Senso out of the box so you do NOT need to do anything with these. They include:

Categories (especially IWF URLs and CTIRU URLs) - these are turned off because they are filtering categories and covered by HomeProtect and SchoolProtect.
Logging turned on/off - the default is that logging is ON for the student group and OFF for the staff and catch-all group.
SafeSearch - this toggle only affects the iPad app, but should be left turned on.

Is it linked to USO?

No, the system is independent of USO. Those with access to the portal do so via Microsoft or Google logins.

Do I need a DPIA?

LGfL cannot decide on your behalf if this is necessary or not - we suggest that you discuss the service with your data protection officer (DPO) and read the LGfL Monitoring Service Privacy Policy.

Testing before you Launch

TESTING post-installation: how do I check that it is operational?

You should verify your installation in the same way as you would any other software, both via the initial MDM, portal or other means of installation but also by spot checks on devices to see that the software is there.

Once you have done this, you can also check within the Senso portal by clicking on > Devices where you can expect to see a long list once the installation has taken place. Please make sure these are in the ‘Student Devices’ folder (the top-level folder is not monitored to help you avoid filtering staff devices).

Step 1 – make sure student devices are not appearing in the top level folder but in “_Students (Monitored)” which was set up by default for you. The top level folder is not monitored and nor are any subgroups you set up unless you change the setting.
Step 2 - check if all the devices you would expect to see are present in this list (as soon as it has been installed you can expect to see them if they have an internet connection).

Thereafter, should you wish to run tests of individual devices, first please check that the software is present. Thereafter, if you wish to trigger a capture to see this appear in the portal, please ensure that the colleagues who receive notifications are aware before you do so and agree a term to use (e.g. 'bomb').

IMPORTANT - Chromebook extension rollout can fail

We have had schools which have enforced the Chromebook extension but where this has not appeared on all devices, due mostly to Chromebook storage/memory being full - in this case the Chromebook cannot follow the command to install the new extension.

To avoid this, we recommend the following:

Use the apps and extensions report to check for failed installs and other error messages. Google's instructions are here.
To avoid low storage space being an issue, turn on ephemeral mode on your Chromebooks. This removes all profiles from the device upon each log off and deletes all download files, creating storage space. Warn users before enabling this as downloads will be removed (recommend using Google Drive for files). Ephemeral mode is described by Google here.

Monitoring and Reporting

Does it monitor all applications on the device or only the browser?

On Windows and Mac devices, all applications are monitored (including, for example, what you type in Word and any other application, not just in the browser). On Chromebooks, Play Store apps are not monitored but as long as you do not allow communication apps outside the browser, this will still retain full device coverage. Mobile devices are different, however. Apple does not allow device inspection in the same way as for devices on other operating systems. This means that you will need to use the Senso browser app and uninstall and block other browsers (Chrome, Safari, Firefox, etc). To mitigate against this limitation, be sure to use an MDM to block other browsers, to block other communication apps and social media.

Microsoft Teams is an exception - this can be monitored at all times and on any device.

What is the Microsoft Teams monitoring function?

Available at no extra cost to LGfL-broadband schools using the managed monitoring service (extra Teams licence required for those using the unmanaged service), the MS Teams chat monitor is agentless - this means that it will work on any device where a pupil is logged into Teams. If your school uses Teams, be sure to roll this out as well via your MS Office 365 portal. Find out more in the Teams KB articles.

Can you export serious captures to CPOMS & myConcern?

Yes - there is a button to export to CPOMS or to myConcern (also available as a simple download) which requires you to amend permissions within your logging system and you can find instructions in the KB for CPOMS and myConcern.

How do I run reports on our monitoring?

You can access an extensive report library from the Logging section of the portal (go to Analytics >>> Reports >>> Keystroke logs). There is more information about the reports that can be run in the DSL How to Guide.

Supporting Groups of Schools

Transition to LGfL-Senso from another reseller - what do I need to know?

If you previously had Senso from another provider or your tech provider uses the network management tools from Senso and now you will be using the safeguarding module from us, you may have more questions - please download the explainer in the KB which will answer your questions.

Providing IT support for multiple schools with Senso?

If you are an IT support company (MSP / 3PSO / DTP) who provides support to more than one school using Senso, you will need an "MSP Portal". This is free and allows a technician's email to be assigned to administer more than one school's Senso portal. When your schools’ portals have been created, you will be able to see these by switching organisation. You can also give 'delegated access' within the MSP portal to other team members. IMPORTANT - when you deploy Senso you must use the school's licence key, not the one linked to your MSP portal which will only have a handful of licences for testing and delegate technician access.

Can I submit a bulk request for multiple schools rather than fill out many forms?

For Multi-Academy Trusts: We can send a template to upload information in bulk (technical contacts and DSLs) following eligibility checks. Complete the expression of interest form at monitoring.lgfl.net for your trust.

For IT support organisations: We can also send a template to upload information in bulk for eligible schools. Do not request monitoring products without the express knowledge of the Headteacher or DSL of each school.

What else do I need to know if I am from a MAT?

We will set up schools within a MAT with the presumption that they will be centrally managed and should sit under the umbrella organisation. This will not mean that DSLs in a single academy will see captures from another but it will mean that the central safeguarding team can see all schools and also the central technical team can do similar. If you wish to be a standalone setup rather than a subsite of your MAT's portal, you must let us know.

Training and Support

Is there training for technicians?

Yes, there is self service training for technicians on how to roll out the software that shows you the process from end to end. To access our new self-service training about LGfL Senso monitoring, please visit learn.senso.cloud and log-in using your Google or Microsoft credentials. If you do not have a login with either of these, click on ‘forgot password’ to generate a password for your account with the email address provided to LGfL for provisioning. If you need access but are not nominated as DSL or Tech Lead, complete the Senso Learn Registration Form.

Who can I contact for more support?

Once your portal has been set up, you will be invited to training and sent key links to support guides. Where you have questions, please use the following inboxes:

monitoring@lgfl.net for general queries
lgfl@senso.cloud for technical queries (setup/configuration)
monitoring.requests@lgfl.net for eligibility questions
monitoring.sales@lgfl.net to receive a quote for other modules

There is also a support chat option in the Senso portal; ensure staff can access the web chat category or the single URL freshchat.com (do not allow for students).

Other

Other Senso modules: LGfL-Senso relationship is centred on monitoring tools for safeguarding but we can offer other tools such as Classroom Cloud and Network Cloud. Request a quote via the online form and email monitoring.sales@lgfl.net for queries.

iPad usage note: When using the iPad browser app, sign-in with Microsoft or Google account. Advise teachers to properly close the app at end of class (double click home and swipe away) so the next user does not appear on the same account.