Schools share student records with ed tech vendors under FERPA's school official exception, which puts the vendor under the school's direct control for that data. State laws such as California's SOPIPA and New York's Education Law 2-d add bans on targeted advertising and security requirements. What vendors sign, what they must build, and how to answer district security reviews.
FERPA governs education records held by schools that receive federal funding. Vendors are usually brought in under the school official exception: the school may share records with a contractor performing a function it would otherwise do itself, provided the vendor is under the school's direct control regarding the records and uses them only for authorized purposes.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Tenant isolation by district, so one district's data cannot appear in another's, enforced in the database and not only in the application.
Deletion by district and by student, including backups on a defined schedule and any analytics or AI indexes.
Roster integration through standards districts already use (OneRoster, Clever, ClassLink) rather than spreadsheets.
Audit logs of staff access to student records.
Breach notification procedures that meet the shortest timeline in your signed agreements.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
The 2025 COPPA Amendments: What Kids' Apps and Ed Tech Must Do Now
The FTC's amended COPPA Rule, published April 22, 2025, required compliance with most provisions by April 22, 2026. Sharing children's data with third parties, including for targeted advertising, now needs separate parental consent; data may be kept only as long as reasonably necessary; and biometric identifiers count as personal information. What changed and what to check in your app.
Read
Law Firm Security in 2026: What Clients' Outside Counsel Guidelines Ask For, and How to Answer
Corporate clients increasingly send outside counsel guidelines and security questionnaires before engaging a firm. The requests are predictable: MFA, encryption, incident notification, data return and destruction at matter end, vendor controls. The ethical baseline (Model Rule 1.6(c) and ABA Opinion 483), the common asks, and how mid-sized firms meet them without an enterprise security team.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.