Independent · snapshot 24 July 2026

What each maths school actually runs

A technology and data-processing dossier for all twelve UK specialist maths schools and the U-Maths network — web hosting, CMS, DNS, domain registration, email, DMARC, third-party SaaS signals, and a plain-English read of every privacy policy. Compiled from public records, not press releases.

13
dossiers (12 schools + U-Maths)
6
run WordPress — all on 7.0.2
9
route mail through Microsoft 365
3
enforce DMARC at p=reject

Why a tech dossier?

These schools compete for the same applicants and publish glossy prospectuses — but the plumbing underneath tells its own story. Who hosts the site? Where does the email really go? Who processes a 15-year-old's data, and does the cookie banner match what the page actually loads?

Everything here is observed from public sources — DNS records, WHOIS/RDAP, HTTP response headers and each organisation's own published policies — on a single day. It is a snapshot, and infrastructure changes; treat it as a point-in-time reading, not a live feed. Where a site loads more than it discloses, we say so. Where something couldn't be confirmed, we say that too. Here's exactly how it was gathered.

What stood out

Full comparison →
Shared plumbing

Exeter and U-Maths run the identical stack

WordPress on Kinsta behind Cloudflare — because the same Exeter college group owns both domains. The network site is, in infrastructure terms, an Exeter Maths School site.

A three-school cluster

Exeter, King's and Liverpool all run Bromcom

The same student information system (MIS) processes pupil data at three otherwise-unrelated schools. Lancaster uses CEDAR instead; Aston and Imperial name Applicaa for admissions.

Policy vs. practice

Several cookie banners don't match the page

Leeds and Liverpool run no consent banner while firing Google and Meta trackers; Imperial's banner is notice-only; Lancaster and 1729 load ad-tech their policies never mention.

The outlier

1729 has the most commercial stack — and a borrowed policy

A Remix + Sanity site with HubSpot, Meta, Reddit and Google Ads pixels, whose only privacy notice is Mill Hill's group document that never mentions 1729.

Security hygiene

Only three schools reject spoofed mail

Lancaster, Durham and 1729 publish a strict DMARC p=reject. Most publish a monitor-only record or none at all — a common gap across UK schools.

The quiet one

U-Maths is the most privacy-conservative

First-party AnalyticsWP instead of Google Analytics, an outsourced DPO, and no Meta or Google trackers at all — the cleanest setup in the network.