Managing IT for Witherslack Group does keep me up at night sometimes. Keeping our data secure is an ongoing challenge. When I say our data is sensitive, I mean a breach could genuinely destroy lives.
We care for some of the UK's most vulnerable children: young people who have experienced sexual exploitation, kids whose parents cannot know their location, children from backgrounds most people could not imagine.
The Weight of What We Hold
We operate 85 sites across the UK now, up from just eight when I started 20 years ago. Every school and every children's home we own holds information that must never leak. We have something called the “Invoke Darkness” protocol, which sees us shut everything down immediately if we even suspect a cyber attack. No hesitation. We cannot afford to lose anything about these children. It is that simple.
When Simple Becomes Impossible
For years, our approach was straightforward. Everything was UK-based and everything was under our direct control. Post-Brexit, we became even more rigid about it. Our previous board wanted physical servers that we could literally pick up and walk out the door with if something went wrong. Our IT infrastructure had always been built around control. It had to be.
But as we grew and expanded into the UAE and Denmark, managing data across multiple jurisdictions, each with its own interpretation of GDPR, introduced complexity we could not ignore.
Denmark’s data protection office did not see things the way the UK’s Information Commissioner’s Office did. Our strategy was no longer fit for purpose. We needed Danish data to stay in Denmark and UAE data to stay in the UAE. Only essential information could flow back to the UK. We needed this infrastructure live and fast. Multiple sites were coming online, and we could not afford to wait.
Our hardware was reaching end-of-life. We had a choice: spend heavily on new servers or consider something our board had always been sceptical about, moving to the cloud.
Building a Secure Ecosystem
We had worked with Pulsant for 12 years, with the same account manager throughout. That kind of consistency matters when you are protecting children, not just data. The conversations about moving to Pulsant’s private cloud took months. This was not because they were slow, but because they were listening to our issues. They understood that “data sovereignty” was not just a compliance tick box exercise. It was about safeguarding lives. We talked through our expansion plans and the international complications, and they came back with solutions. Not pitches. Solutions.
The key to the project’s success was integration. Pulsant built us a fully encrypted MPLS network with private pathways between our sites, where nothing touches the public internet unless we say so. They then integrated this directly into their private cloud infrastructure, creating what I think of as a secure ecosystem.
For Denmark, this meant we could provide a secure link into our network for controlled data transfer when absolutely necessary. Their data stays in-country. It is data sovereignty that works in reality, not just on paper.
What Trust Actually Looks Like
Our partnership with Pulsant is long-standing for a reason. When they say something is not possible, I believe them. Not because I am naive, but because I know they have tried everything first. They will talk to every department, explore every angle, and look at every solution. If there is a way to make something work, they will find it.
But they will not pretend. They will not say yes just to keep us happy when the answer is genuinely no. Paradoxically, that is what makes me trust them with our most sensitive data.
The infrastructure has been rock solid. When we need to scale up, sometimes within hours, it happens. Issues get resolved fast. Beyond the technical specifications, there is something harder to quantify. I sleep better knowing they understand what is actually at stake.
This is not about servers or compliance frameworks. It is about children who have already been let down too many times. Every decision we make must be through that lens, and we need partners who share it.