Trust & privacy
How we handle student and family data
IEP Advisor holds some of the most sensitive records a school keeps. This page states, plainly, what we store, who can see it, how long we keep it, which vendors touch it, and how our AI features are governed. Last updated 2026-09-16. Statements describe the product as configured; a signed data-processing agreement governs a pilot.
What we store and who sees it
- School records (rosters, IEP/ETR/504 drafts and finalized versions, meetings, decisions, goal progress, evaluation cases, signed copies) belong to the district. Access follows role and student assignment: a case manager sees their students; a provider sees the students on their team; administrators see their school or district.
- Family data (child profile, uploaded documents, contributions, questions asked of the AI) belongs to the parent. Private questions and notes are never visible to school staff. What a parent chooses to respond to a shared draft is visible to the student's team.
- Immutable records. Finalized versions, shared revisions and the audit log cannot be edited or deleted — the application layer and the database both refuse. Every view, share, export and delete is written to an audit log that administrators can review, and the log's integrity is checked daily.
- Exports. A district can export its full record (PDFs, signed copies, values, goals, meetings, family responses that staff could already see, and an audit extract) at any time. Private parent notes are never included.
Retention and deletion
- School records are retained for the term of the agreement and returned or deleted at its end, per the district's records schedule.
- A parent can request account deletion in the app. The request can be cancelled for 30 days (including from the emailed link, even if the session was revoked); after that the account, children, uploaded documents, analyses and private notes are purged, including files in storage.
- A staff account that is closed is anonymised; the school records it authored stay with the district.
- Backups roll off on a fixed schedule; purged data leaves backups within that window.
AI governance
- A human approves every word. AI drafts suggestions, explanations, briefs and summaries; nothing is written to a record or sent to a family without a person accepting or editing it.
- Sources are shown. Suggestions cite the evidence they came from (prior versions, evaluations, family input); answers to parents cite the draft. Ids the model references are checked by the server — unknown citations are dropped.
- Data sent to the model is bounded. Only the document or draft in question and evidence the user is already allowed to see; family questions never include other students or staff-only notes. Document text is not written to application logs.
- No training on customer data. This is a contractual guarantee, not an application setting: we use our model provider (Anthropic) through its commercial API, whose terms exclude training on content submitted through it. We will name the governing terms in the data-processing agreement.
- Billing. AI use by families on a district's shared drafts is billed to the district, never gated by a parent's subscription.
Sub-processors
| Vendor | Purpose | Data |
|---|---|---|
| Microsoft Azure | Hosting, database, file storage, email delivery (Communication Services) | All application data; email addresses and message content |
| Anthropic | AI drafting, explanations, briefs | The document/draft and evidence in scope for the request; commercial API terms exclude training on content |
| Stripe | Parent subscription billing | Parent name, email, payment details (held by Stripe) |
| Sentry | Error monitoring | Technical error data with a numeric user id; no email, no request bodies |
We notify districts before adding a sub-processor.
Accessibility
We build to WCAG 2.1 AA: keyboard-operable dialogs and forms, live regions for asynchronous results, visible focus, reduced-motion support, and phone-first reading views for families. Charts carry a text alternative. If something gets in your way, email support@iep-advisor.com — we reply within one business day and treat accessibility defects as blocking.
Agreements and contact
A data-processing agreement (including FERPA "school official" terms and a breach-notification commitment) is available on request and precedes any pilot with real student data. Questions: privacy@iep-advisor.com.