FERPA aligned
We sign your district’s Data Processing Agreement and act as a “school official” under FERPA’s school-official exception. Student data stays under your direct control — never sold, shared, or rented.
Security and privacy
Built to protect student data at every layer.
We sign your DPA. We act as a school official under FERPA. We don’t train AI on your data, and we don’t run ads. Your district owns its data — we just hold it carefully.
SOC 2 Type 2
Symplifyed is SOC 2 Type 2 attested by Prescient Assurance, audited annually over a real operating period — not a one-time checklist. Our production infrastructure (Vercel + Neon) is separately SOC 2 Type 2 attested as well.
Access control
Teachers only see their assigned students. Admins see their school. District leaders see the whole picture — nothing more. MFA enforced on our cloud infrastructure, source code, and database.
No AI training
Our AI sub-processors (Anthropic, OpenAI) are contractually prohibited from training on submitted content. No student data ever goes into a general-purpose model — yours or anyone else’s.
What we never do
- Sell, rent, or lease student data
- Train AI models on your data
- Run targeted advertising
- Market to students or parents
- Build profiles outside K-12 purposes
You own your data. Always.
Districts maintain full ownership of student data. Export anytime — full return or deletion within 30 days of contract end. We give 30 days’ advance notice before adding any new sub-processor that handles Student Data, so you always know who touches your data.
How we handle data
From your district to ours and back.
Here’s exactly what happens to student data once it enters Symplifyed. Four stages. No magic. No surprise data trips.
- In transit
Encrypted on the way in.
All data traveling between your district’s devices and Symplifyed is encrypted with TLS 1.2 or higher. HTTPS-only, no exceptions. We reject any connection attempting to use older, weaker protocols.
MFA is enforced on all our cloud infrastructure and developer tooling (Vercel, Neon, GitHub, Google Workspace). Google sign-in is available for teachers today; enterprise SSO (SAML/OIDC) with Google Workspace and Microsoft Entra is on our 2026 roadmap for district deployments.
- At rest
Encrypted in storage.
Data at rest is encrypted with AES-256, the same standard used by US government systems. Our production database (Neon) and file storage (Vercel) are both SOC 2 Type 2 attested.
Database backups are encrypted, geographically separated, and retained for 30 days. Older backups are cryptographically erased on a rolling basis.
- In use
Access is least-privilege by default.
Inside Symplifyed, role-based access controls keep teachers seeing only their assigned students, administrators seeing only their school, and district leaders seeing the rollup. We don’t have a “see everything” button for end users.
On the company side, employee access to production data is restricted to engineers on-call for active incidents and logged. We don’t use student data for product analytics, never sample it for testing, and don’t load it into anyone’s local environment.
- On the way out
Export, return, or delete — your call.
Districts can export their data at any time during the contract. When a contract ends, we’ll either return the data to you or permanently delete it from production and backups within 30 days, per your DPA preference.
Deleted records persist in encrypted backups only until our standard retention window expires (30 days), after which they’re permanently gone.
If something goes wrong
Our incident response, in plain English.
If there’s ever a security incident affecting your data, here’s exactly what we’ll do and when.
Detect, contain, assess
Automated monitoring alerts our security team. We contain the issue, take affected systems offline if needed, identify scope, and document every decision.
Notify districts
Affected districts get a written notice with what happened, what data was involved, and what we’re doing about it. No legalese, no spin.
Post-mortem
You receive a full written incident report: root cause, remediation steps, and what we changed so this can’t happen the same way again.
Found a security issue or have a concern? Email security@symplifyed.com. We take every report seriously and respond within one business day.
FAQ
The questions we get most.
Will you sign our district’s DPA?
Yes. We sign district-specific DPAs as a matter of course. We also have a standard DPA available if your district wants a starting point.
For districts using state-level DPAs (NDPA, Massachusetts SDPC addendum, California exhibits, etc.), we sign those too.
Are you FERPA compliant?
Yes. Symplifyed operates as a “school official” under FERPA’s school-official exception (34 CFR § 99.31(a)(1)). That means we only access student data to perform services on behalf of the district, under direct district control, and we maintain confidentiality of all records.
We do not redisclose student data outside the district’s instruction without consent.
What about COPPA?
For students under 13, Symplifyed relies on the school’s authority to provide consent under COPPA, in line with FTC guidance. The district is the consenting party on behalf of parents for educational uses of the platform.
We do not collect personal data from students directly for any purpose outside the district’s educational use.
Where is our data stored?
Student data is stored and processed within the United States. Our production database (Neon) and application layer (Vercel) run in US regions. AI sub-processors (Anthropic, OpenAI) commit to US-only data residency under their API terms.
Do you use AI? If so, how?
Yes. We use AI sub-processors (Anthropic and OpenAI) for specific features inside Symplifyed. We have contractual no-training agreements with both: student data submitted to these services is never used to train their models.
AI features are scoped to assist teachers and administrators — they never make decisions about a student on their own. A human is always in the loop.
What happens if a sub-processor changes?
We give districts 30 days’ advance written notice before adding or changing any sub-processor that handles Student Data. The current list is always available on our sub-processors page.
If you object to a new sub-processor, we’ll work with you to find a path forward.
Can teachers see other classrooms’ data?
Access is enforced at the role level. Teachers only see their assigned students. Admins only see their assigned schools. These boundaries are verified server-side on every request, not just hidden in the user interface.
What happens to our data when the contract ends?
Per your DPA, we either return all data to your district or permanently delete it within 30 days of contract end. Deletion includes backups.
You can also export your data at any time during the contract — no need to wait for it to end.
Are you SOC 2 attested?
Yes. Symplifyed is SOC 2 Type 2 attested by Prescient Assurance, audited annually over a real operating period — not a one-time checklist. Our production infrastructure (Vercel, Neon) is separately SOC 2 Type 2 attested as well.
We can share the full attestation report under NDA for districts in active evaluation — email privacy@symplifyed.com to request a copy.
How do I report a security concern?
Email security@symplifyed.com. We respond within one business day, take every report seriously, and treat responsible disclosure with respect.
For general privacy questions or data access requests, email privacy@symplifyed.com.