Services · PenwinSafe
PenwinSafe: safe browsing for students in and out of school
PenwinSafe is PenwinEdu's safe browsing platform for schools and colleges: protection is installed on the device itself, so it travels with the device and applies on any network, in and out of school. It always blocks pornography, malware, fraud, scams and hate, without the student being able to switch it off, and on devices with the Chrome extension or the PenwinSafe browser it analyses searches with artificial intelligence and alerts the form tutor to patterns of bullying, self-harm or violence. From €3.50 per device per year, with a free demo.
Request a free demo at info@penwin.org: we'll trial PenwinSafe with a group at your school before you sign up to anything.
Three ways to protect, depending on the device
The three modes run side by side in the same school and are managed from the same dashboard, with no duplicated management.
- DNS only, with nothing to install: our own DNS server, with classic DNS and DNS over HTTPS (DoH), domain filtering and enforced SafeSearch on Windows, macOS, Linux, ChromeOS, iOS and Android, and on any other device on the network.
- Chrome extension (Manifest V3, on the Chrome Web Store), for Chrome and Chromebooks: keyword blocking, analysis of searches with artificial intelligence, enforced SafeSearch on Google, YouTube, Bing and DuckDuckGo, capture of the visible tab and blocking of chrome://settings and chrome://extensions.
- PenwinSafe desktop browser, for Windows – installer and portable version, 64-bit and 32-bit – and macOS 10.15 Catalina or later, Intel and Apple Silicon: DNS filtering over DoH, AI analysis of searches, full-screen screenshots and live screen view via WebRTC. It closes any other browsers opened on the device and alerts the dashboard; it works in fail-closed mode.
- Always blocked, in every mode, and cannot be switched off from the dashboard: pornography, malware, fraud, scams and hate.
- Categories the school decides on: gambling, social media, streaming, advertising, games, dating, downloads, drugs, crypto and news.
- Device enrolment with a school code; single-command agent for UniFi equipment.
Artificial intelligence alerts for the form tutor
On devices with the Chrome extension or the desktop browser, PenwinSafe analyses the student's searches and raises the alert on the spot. The analysis is carried out on the platform, not on the device, with an artificial intelligence model from Anthropic (Claude) that places each search within ten categories and five risk levels; certain critical patterns relating to suicide, self-harm and making weapons or explosives trigger an immediate alert without waiting for classification. Each alert comes with category, level and context.
Live screen, remote lock and reports by student
From the service dashboard, the teacher acts without being in front of the student.
- Live screen view via WebRTC on devices with the PenwinSafe desktop browser, which also captures the full screen; with the Chrome extension, capture of the visible tab.
- Remote lock: browsing on the device is cut off instantly from the dashboard and restored just as quickly.
- Activity reports by student: pages visited, searches, blocked events and screen time per day.
Children's data: what we provide to the school
The school is the data controller and PenwinEdu the processor. We provide the data processing agreement and details of what the service records in each mode and where searches are analysed, so the school can complete its record of processing activities. We cover the legal framework on our blog.
Pricing, demo and who is behind it
PenwinSafe starts at €3.50 per device per year: the cost is calculated per protected device, not per site or by number of classrooms. Before you sign up there is a free demo with a small group.
Behind it is a company that specialises in education – publicly funded private schools (concertados), private schools, universities, business schools and vocational training centres – with more than twelve years' experience managing their infrastructure in Spain. Today the company manages more than 300,000 daily connections, 600 TB of traffic and more than 1,200 switches and firewalls, with 24/7 monitoring and a technical support response within 4 working hours.
- Service access: https://safe.penwin.cloud (in Spanish) · Contact: info@penwin.org
- PenwinSafe Familias app for parents and guardians, on Google Play and the App Store: alerts, statistics and the screen of the protected device.
- Offices in Spain: Benet Cortada 14, 08174 Sant Cugat del Vallès · Av. de los Poblados 151, 28025 Madrid · Almagro 14, 23002 Jaén.
Frequently asked questions
Can a student switch off PenwinSafe filtering?
Not from the device itself when the school manages the deployment: the policy is set from the dashboard and the profile is installed and locked from the device's management console. The Chrome extension also blocks chrome://settings and chrome://extensions, and the desktop browser works in fail-closed mode: if the DNS service does not respond, there is no browsing.
Does PenwinSafe work outside school, on the home network?
Yes, when protection is applied on the device itself: a DNS profile installed on the device, the Chrome extension or the PenwinSafe desktop browser. Filtering stays in place on any Wi-Fi network – at home, at a relative's, at a library – and the family does not have to configure anything on their router.
What exactly does the form tutor see with PenwinSafe?
Activity reports by student – pages visited, searches, blocked events and screen time per day – the alerts that artificial intelligence raises when it detects worrying patterns in searches, and screenshots. Live screen view via WebRTC is available on devices with the desktop browser; the Chrome extension captures the visible tab.
What about the student's privacy?
PenwinSafe processes children's personal data: the school must rely on an appropriate lawful basis, put the data processing agreement in place and document what data is processed, how long it is kept and who has access to it. Depending on the mode deployed, the service records the URL and title of each page visited, the text of each search, blocked events, screenshots and daily screen time.
Which devices does PenwinSafe support?
DNS-only filtering, which needs nothing installed, works on Windows, macOS, Linux, ChromeOS, iOS and Android; there are guides and profile installers for UniFi, Windows, macOS, iOS (.mobileconfig profile), Android (Private DNS), Chromebooks (Google Admin) and Firefox. The extension is for Chrome and Chromebooks; the desktop browser is for Windows (installer and portable, 64-bit and 32-bit) and macOS 10.15 or later, Intel and Apple Silicon.
How much does PenwinSafe cost?
PenwinSafe starts at €3.50 per device per year. The cost is calculated per protected device, not per site or by number of classrooms: at the starting price, protecting 500 devices costs €1,750 a year. For a fixed quote, email info@penwin.org.
How soon is PenwinSafe up and running?
The school's sign-up and first policy are done on the same day; from then on, the pace depends on the size of the device fleet and how the devices are managed. Each device is enrolled with the school code: you download the installer or add the extension, enter the code and it is linked. The roll-out can be done in phases.
Let's talk about your school
Email us at info@penwin.org with details of your school, or fill in the contact form, and we'll reply with a specific proposal.