Updated 14 days ago
Approved Tools#
This document lists the AI coding tools Springpod has approved for use, and what build paths each tool is approved for.
AI coding tools approved for use#
| Tool | Tier | Approved for | Not approved for | Notes |
|---|---|---|---|---|
| Lovable | No-Code | Green, Yellow builds | Orange+ builds | Quick prototypes only. GitHub sync + ZIP export. Supabase for data. Do not use for anything touching student data. |
| Replit Agent | Low-Code | Green, Yellow builds | Orange, Red builds | Good for internal tools. Data residency not confirmed for UK GDPR compliance on student data. |
| Bolt.new | No-Code | Green builds | Yellow+ builds | Fast prototyping. Built-in PostgreSQL + Supabase since V2. Green builds only (platform maturity still being evaluated). |
| Cursor | Pro Tool | All build paths | — | Full code control, approved by engineering. Preferred for Orange and Red builds. |
| Claude Code | Pro Tool | All build paths | — | Full code control, CLI-based. Approved for all paths including student-facing features. |
| GitHub Copilot | Pro Tool | All build paths | — | IDE-integrated code assistant. Code suggestions must be reviewed before committing. |
| ChatGPT / Claude (chat) | Assistant | Research, drafting, brainstorming | Pasting student data or confidential info | Never paste real student data, employer contracts, or financial information into chat interfaces. |
See the Tool Selection Guide for a full explanation of No-Code, Low-Code, and Pro Tool tiers, including strengths, limitations, and when to use each.
GitHub Copilot now offers five tiers: Free, Pro ($10/month), Pro+ ($39/month), Business ($19/user/month), and Enterprise ($39/user/month). For Springpod:
- Green builds: Free or Pro tier is sufficient
- Yellow builds: Pro or Business tier (chat + code suggestions)
- Orange+ builds: Business or Enterprise tier recommended (audit logs, policy controls, IP indemnity)
All tiers: code suggestions must be reviewed before committing. Agent mode (available in Pro+ and above) requires the same review discipline as any AI-generated code.
Other approved services#
| Service | Type | Approved for | Notes |
|---|---|---|---|
| Vercel | Hosting | Green, Yellow, Orange | Preferred for frontend deployments. Red builds require additional security review. |
| Supabase | Database | All build paths (with review for Red) | Row-level security must be enabled for any student data tables. |
| OpenAI API | AI API | Orange, Red (with Data team sign-off) | Must not send raw student PII. Use anonymised or aggregated data only. |
| Anthropic API | AI API | Orange, Red (with Data team sign-off) | Same data handling rules as OpenAI. Preferred for the Interview Skills Coach. |
| Google Analytics | Analytics | Green, Yellow only | Not approved for tools serving students under 18. Use privacy-respecting alternatives for student-facing tools. |
| PostHog | Analytics | All build paths | Self-hosted option available. Approved for student-facing with anonymised tracking. |
| HubSpot | CRM/Marketing | Internal and partner-facing only | Not for student-facing tools. |
| Segment | Data Pipeline | Internal analytics only | Do not route student PII through Segment. |
Requesting a new tool#
If you want to use a tool that is not on this list:
- Post a request in the #tools-and-tech Slack channel with: tool name, intended use, build path, and whether it will touch student data
- The Engineering Lead reviews security and data handling within 5 business days. Tools touching student data also require Data team sign-off.
- The tool must comply with UK GDPR, have a clear privacy policy, not store data outside approved regions (UK/EU), and support SSO or team-based access where available.
Every external tool your team uses is a potential data flow. If a tool sends your data somewhere you have not vetted, you cannot guarantee your users' privacy. The approval process is not bureaucracy — it is protecting your users and Springpod.
Tools explicitly not approved#
| Tool | Reason not approved | Date evaluated |
|---|---|---|
| Notion AI | Under re-evaluation — DPA with UK SCCs now published (March 2026). Content moderation controls for under-18 use still unconfirmed. | Mar 2026 |
| Jasper | Marketing-focused, no controls for age-appropriate content generation | Feb 2026 |
| Midjourney | Restricted enterprise API now available. No content moderation controls suitable for educational context. | Mar 2026 |
Review schedule#
This list should be reviewed and updated:
- Every 6 months (January and July)
- By the Engineering Lead and Data team jointly
- Also reviewed when: a new tool is requested, a vendor changes their terms, or a security incident involves a third-party tool
Related documents#
- Tool Selection Guide — how to choose between tool tiers
- Company Context — constraints that affect tool approval
- Security Standard — security requirements for all tools
Was this page helpful?