Services · School groups
School groups: a unified network and shared policies across every site
An owning body with several schools does not have one school's problem multiplied by five: it has a different problem. Each site was equipped when it could be, with whichever provider was nearest, so no two are alike, nobody has the full picture and the smallest site always gets the worst service. PenwinEdu connects the sites with SD-WAN, applies the same security and filtering policies at every school and provides a single console for viewing and managing the whole group.
Email us at info@penwin.org and we'll look at the current state of each site in your school group and where it makes sense to start. The initial assessment is free and comes with no obligation.
The problem with a multi-site group
A school group does not have one school's problem multiplied by five. Each site was equipped when it could be and with whichever provider was nearest, so today no two are alike: a different network, a different contact and a different way of dealing with a fault.
That has a cost the owning body pays without seeing it. Invoices cannot be compared, the same issue is dealt with in four hours or in four days depending on the school, and no decision reaches every site at the same time.
- Costs that cannot be compared: no two invoices share the same format.
- Each school with its own contact, its own channel and its own response time.
- No overall view: answering a single question means going site by site.
- Little bargaining power, because the provider sees individual schools rather than a group.
What SD-WAN is
SD-WAN (software-defined wide area network) is the technology that uses software to manage the network connecting distant sites. Security policies, routing and internet access are defined once and applied at every school from a single console, instead of being configured site by site.
The administration network runs on that foundation: security policies, content filtering and access controls are applied consistently across the whole group, which helps protect student and staff data under the EU General Data Protection Regulation.
- Network policies, routing and internet access defined once for the whole group.
- Roll-out to every site from a single console.
- Consistent security policies, filtering and access controls at every school.
Standardisation is the real product
What a school group buys is not a box: it is an end to its sites all being different. Content filtering is applied with the same criteria at every school, and the guest captive portal is shared across the whole group, so a visitor connects in the same way at any site. Internet access is standardised with a Ubiquiti perimeter firewall at each school: the same equipment and the same baseline configuration at every site.
The teaching staff are the ones who appreciate it most: a teacher who moves to another school within the group finds the same way of connecting, the same filtering and the same way of asking for help.
- Content filter with the same criteria at every school.
- Unified guest access, on the same terms at each site.
- A single guest captive portal for the whole group.
- Ubiquiti perimeter firewall at each school, with the same baseline configuration.
Telephony across sites and connectivity
Telephony is where it first becomes clear that the group is a group: extensions are integrated across the schools, so you dial an internal number and it rings at another school without going out onto the telecoms provider's network. PenwinEdu maintains and manages VoIP for the whole group, with a shared extension plan across sites and a mobile app.
Internet connectivity can be included in the same project, with a symmetric fibre line at each site and the bandwidth sized in the initial assessment.
- Extensions integrated across the group's schools: internal dialling between sites.
- Maintenance and management of VoIP, with internal dialling between all the sites.
- Mobile app integration.
- A symmetric fibre line at each site, sized in the initial assessment.
A single view of the group, with the consoles in its name
An owning body needs full and accurate information to be able to answer these three questions: what state each site is in, what each one costs using the same cost headings, and which school genuinely needs investment. That requires a single view of the group and the same indicators at every site, and it is also what makes it possible to negotiate as a group rather than as ten separate schools.
There is also a commitment that should be put in writing before signing: the management consoles are migrated into the group's name. PenwinEdu comes in as administrator, not as owner. Behind it all, 24/7 monitoring and technical support with a response within four working hours.
- A single view of the status of every site, with the same indicators.
- Comparable data across schools to decide where to invest.
- Management consoles migrated into the group's name.
- 24/7 monitoring and technical support with a response within four working hours.
What is unified and what stays with each school
Unifying does not mean deciding everything from head office. The group is responsible for the network architecture, the shared policies, the contract and the measurement. Each school keeps the timing of the work, the priority of its investment and its own named contact, whom we support rather than replace.
The roll-out is carried out in short phases, each with something working at the end, starting with whatever is holding back day-to-day activity today. Five-year master plans do not survive two school years.
Many of the institutions PenwinEdu works with are owning bodies with several schools: foundations, religious congregations and groups of schools. It is the profile we have worked with for longest.
- At group level: the network architecture, the shared policies, the contract and the measurement.
- At each school: the timing of the work, within the agreed windows.
- At each school: investment priorities, based on what is holding back its activity.
- At each school: the named contact, who is supported rather than replaced from head office.
Frequently asked questions
What is SD-WAN and why does it matter to a school group?
SD-WAN (software-defined wide area network) is the technology that uses software to simplify and optimise the management of the network connecting distant sites. In a school group, it allows security policies, routing and internet access to be defined centrally and applied at every site from a single console. The benefit for the owning body is that a decision is taken once and reaches every school, instead of being repeated site by site.
Does the equipment at every site have to be replaced?
Not all at once. What is standardised first is each school's internet gateway, with a Ubiquiti perimeter firewall and the same baseline configuration at every site, because that is what allows shared policies to be applied. The rest of the equipment is reviewed in the initial assessment and replaced in phases, depending on its condition and on what is holding back each school's activity.
Can we start with just a few sites?
Yes, and it is the recommended approach. PenwinEdu works in short phases, each with a visible result at the end, rather than with a five-year master plan that nobody is following two school years later. The first project is chosen on two criteria: that it solves something people are struggling with today and that it serves as a template for the other sites. The pilot site should be representative, neither the best nor the worst in the group.
Who manages the network afterwards, the group or PenwinEdu?
PenwinEdu takes on day-to-day management, with 24/7 monitoring and technical support with a response within four working hours, while the group keeps visibility and control: a single view of the status of every site and the management consoles in its name. The usual split is that the school group decides the policies and PenwinEdu applies and maintains them at every school.
Who owns the management consoles?
The group. The management consoles are migrated into the school group's name; PenwinEdu comes in as administrator and not as owner. It is a condition worth putting in writing with any provider before signing, because it is what makes a change of provider the group's decision rather than a negotiation under pressure.
Can a different policy be applied at a particular site?
Yes. Unifying does not mean that every site has exactly the same, but that what is comparable can be compared and that a decision taken once does not have to be taken again. The base is common to the whole group – filtering, authentication, guest portal and access controls – and justified exceptions are allowed on top of it: a different phase of education, a vocational training workshop or a teaching block with its own needs.
How is it billed, by group or by school?
Either way, depending on the school group. In foundations and religious congregations it is common for several legal entities to coexist, so each school needs its own invoice even if the contract is with the group. What matters is that every site uses the same cost headings, because there is no other way to compare what each one costs.
Does it work if the sites are in different autonomous communities (regions)?
Yes. The network connecting a school group's sites does not depend on where they are: SD-WAN exists precisely to manage distant sites from a single console. PenwinEdu provides its service throughout Spain, with its own offices in Sant Cugat del Vallès, Madrid and Jaén, and the shared policies apply in the same way at every school, whatever the region.
Let's talk about your school
Email us at info@penwin.org with details of your school, or fill in the contact form, and we'll reply with a specific proposal.