Documentation

Central Edition

This page is also in the Groundskeeper wiki: https://github.com/rsjsoftwareltd/groundskeeper/wiki/Central-Edition

The Central edition adds MAT hub-and-spoke aggregation to Groundskeeper, giving a Multi-Academy Trust a single pane of glass across all member schools -- without any school's data leaving its own network.

How it works #

Each school runs its own Groundskeeper instance as normal. The Central hub is a separate Groundskeeper install (at the trust or IT team level) that schools pair with. Once paired, the hub asks each school for its status and brings the answers together in one trust-level view. It asks about every two minutes while someone has a Central page open, and once a week on its own to keep its weekly estate snapshot (and to send the estate digest email, if you switch it on).

There is no cloud layer. The hub asks each school for its status directly, over your existing network or VPN. School data stays within the trust's own infrastructure.

What the hub shows #

• Trust overview -- RAG status across all member schools at a glance
• Per-school drill-down -- click any school to see its category status, its open critical and warning issues, its agent totals and the connectors it has switched on
• Cross-school alerts -- critical and warning alerts from any school surface at the hub
• Version tracking -- see which Groundskeeper version each school is running

Setting up the hub #

1. Install Groundskeeper on the server that will act as the hub (a trust-level server, or the IT team's existing Groundskeeper install).
2. Enter the trust's Central licence key under Settings --> Licence. The server becomes the hub as soon as the key is active -- there is no separate role to choose.
3. Under Settings --> Organisation, set this hub's address as schools should reach it (pre-filled from your browser's address bar), then add each school: enter its name and its https:// address (for example https://10.0.1.10:8443), and its URN if you know it. Its pairing bundle is generated in one step and carries the hub's address. Share the bundle with the school.

When the hub first reaches a school it records that school's certificate, and from then on it only accepts that certificate. If a school's certificate changes, the school's row says so and offers Re-pin. Only use it once you have confirmed the change was expected (for example, the school renewed its own certificate).

Pairing a spoke school #

At each member school:

1. Open the school's Central page (/mat).
2. Paste the pairing bundle the trust gave you (it begins GK-PAIR-V1: and already carries the hub's address) into Pairing bundle from hub.
3. Click Apply pairing. This saves the hub's details. The hub then collects this school's status itself, and the school appears on the hub at its next check.

The school's own dashboard continues to work exactly as before -- pairing lets the hub read the school's summary without changing anything for the local IT team.

Licensing #

Central is available as an annual subscription per trust group (see groundskeeper.rsjsoftware.com for current pricing). Each school in the group holds its own Pro licence; Central is a separate fee for the hub on top, so a group pays for each school's Pro plus one Central. The hub checks each school's licence: a school without a valid Pro (or higher) key is shown as not reached, with that reason, until it has one.

If the hub's Central licence expires, the hub keeps showing the estate as it was when it last collected, read-only and dated, until the licence is renewed. Renewing keeps every pairing. A trust that is giving up Central can turn the hub back into an ordinary school with Convert to a standalone school... on its Central page.

Requirements #

• The hub must be able to reach each school's Groundskeeper over your network (direct or via site-to-site VPN): the hub contacts the schools, not the other way round. Nothing needs to be open to the internet.
• Keep every school on a current release -- the hub's views rely on what recent versions report.
• Windows Server 2022 at each site (the platform Groundskeeper is built and tested on).

FAQ #

Can a school still use its own dashboard after pairing? Yes. Pairing is additive -- nothing changes for the local IT team.

Does the hub store school data permanently? The hub keeps the alerts each school forwards, a weekly estate snapshot, and the last status view it collected. Full school data stays on the school's own server.

What happens if a spoke goes offline? The hub marks that school as unreachable and says why. It shows no status for it, because an old status could look healthy. Alerts the school sent earlier stay on the hub's alerts page, marked Not current. The spoke continues to function normally for its own IT team. Estate Agents and Estate Cyber Essentials say why beside the school ("Not reached: ..."), and the trust's overall Cyber Essentials posture is never green while a school is not reached: it reads amber and says how many schools are missing.

A school that answers, but one of whose connectors has stopped polling, shows grey Not checked recently for those areas. The trust's view never reads "All clear" while that is so.

Can we add schools to the trust after initial setup? Yes. Add the school on the hub (Settings --> Organisation) and apply its pairing bundle on the school's Central page, at any time.

Last updated: 2026-10-17 (v0.192.4)