Security
Student records stay the district's. Our job is to keep them that way.
TPA Ventures works as a school official under FERPA, holds a SOC 2 Type II attestation, hosts only in the United States and never trains models on student data.
Controls at a glance
Eight controls every district CTO asks about.
The same list we walk through in a security review, in the same order.
Encryption
- AES-256 at rest, including backups and file storage
- TLS 1.3 in transit between browsers, connectors and services
- Keys managed in AWS KMS with automatic rotation
Identity
- SAML 2.0 and OIDC single sign-on via Clever, ClassLink, Google Workspace and Microsoft Entra
- MFA enforced for every administrator role
- Staff removed from your identity source lose access within one sync cycle
Access control
- Roles: director, coordinator, case manager, related service provider, principal, read-only auditor
- Least privilege by default; building-scoped views for principals
- Case managers see their caseload, nobody sees students outside their scope
Hosting
- AWS us-east-1 primary, us-west-2 disaster recovery
- United States only; no student data leaves U.S. regions
- Network isolated in private subnets behind a web application firewall
AI isolation
- Student data processed in isolated inference with zero retention by model providers
- Never used to train, fine-tune or evaluate models, ours or anyone else's
- Prompts and outputs logged for the district only, visible to your administrators
Audit logging
- Every draft, edit, export and sync is attributed to a user and time-stamped
- Immutable log with student identifier and field changed
- Exportable for state monitoring, records requests and due process
Backups and continuity
- Encrypted daily backups with 35-day retention
- RPO 24 hours, RTO 8 hours
- Restores tested quarterly; results recorded for the SOC 2 audit
Vulnerability management
- Annual third-party penetration test
- Dependency and container scanning in CI on every build
- 72-hour SLA for critical fixes; coordinated disclosure at security@ and /.well-known/security.txt
Compliance and attestations
What we can show you, and the exact words we use.
Where TPA Ventures holds no formal attestation, the table says aligned. We do not claim ISO 27001 or FedRAMP.
| Framework | Status | Detail |
|---|---|---|
| SOC 2 Type II | Attested, annual | Independent audit of security, availability and confidentiality controls over a 12-month period. Report available to districts under NDA. |
| FERPA | School official | Operates under the school official exception, 34 CFR § 99.31(a)(1)(i)(B), with direct district control over use and maintenance of records and no redisclosure. |
| COPPA | School authorization | Students never create accounts. Any information about children under 13 is collected by and for the school for an educational purpose under 16 CFR Part 312. |
| Student Privacy Pledge | Commitments in contract | The Future of Privacy Forum retired the Pledge program in April 2025. Its core commitments are written into every TPA Ventures customer agreement. |
| SDPC National Data Privacy Agreement | Signed, with state exhibits | NDPA v1 or v2 as adopted by your state alliance, including Exhibit G state terms and the Exhibit E General Offer of Terms. |
| State student privacy laws | Signed addenda | New York Education Law § 2-d, Illinois SOPPA, California SOPIPA and AB 1584 terms, Texas Education Code Chapter 32 Subchapter D. Aligned with the cybersecurity framework Texas districts adopt under SB 820. |
| NIST Cybersecurity Framework | Aligned | Administrative, physical and technical safeguards mapped to the CSF functions and recorded in NDPA Exhibit F. |
| WCAG 2.1 AA | Conformance target | Website and application tested against WCAG 2.1 Level AA and the Revised Section 508 Standards. VPAT available on request. |
SOC 2 report, penetration test summary and VPAT are shared under NDA through your security contact.
Shared responsibility
What TPA Ventures does, and what stays with the district.
Data stays inside the district's own tenant, so de-identification before upload is not required. The split below is written into the NDPA.
TPA Ventures
- Encrypts, hosts and backs up all customer data in U.S. regions
- Runs drafting in isolated inference with zero provider retention and no model training
- Enforces the roles and scopes the district configures, and logs every access
- Maintains the SOC 2 Type II program, annual penetration test and vulnerability SLAs
- Binds every subprocessor to terms at least as protective as the NDPA, with 30 days' notice of changes
- Notifies the district within 72 hours of a confirmed breach and supports parent notifications
- Returns and deletes data on termination with a certificate of deletion
The district
- Keeps rostering accurate so caseload and building scopes match reality
- Sets SSO and MFA policy in Clever, ClassLink, Google Workspace or Microsoft Entra
- Decides who gets which role, and removes staff from the identity source when they leave
- Authorizes in writing which students and fields each connector may read
- Reviews and finalizes every draft through certified staff and the IEP team
- Handles parent requests to inspect, review or amend records, with our support
- Does not need to de-identify data before upload: it never leaves the district's tenant
Data lifecycle
Five stages, each one logged.
- 01
Ingest
Rosters and case data arrive through a scoped connector (OneRoster, Ed-Fi, vendor export) or a staff upload. Only the students and fields the district authorizes in writing come in.
- 02
Process
Drafting requests run in isolated inference inside U.S. regions. Model providers retain nothing and train on nothing. Every extracted score links back to its source row.
- 03
Store
Data is tenant-scoped and encrypted at rest. One district cannot see another district's students, and support staff cannot see student records without a logged, district-approved session.
- 04
Export
Approved drafts go back to the IEP system or SIS of record. The district's system stays the system of record; TPA Ventures keeps the audit trail.
- 05
Delete
Within 60 days of contract end, or sooner on written request, student data is returned and deleted with a written certificate of deletion. Encrypted backups age out within 35 days after that.
Report a vulnerability
Found something? Tell us before you tell anyone else.
Email security@tpaventures.si with steps to reproduce. We acknowledge reports within one business day and fix critical issues within 72 hours. Ask for our PGP key in your first email if you need to send an encrypted report. Our disclosure contact is published at /.well-known/security.txt.
Safe harbor: research conducted in good faith, within scope, that avoids student data and does not degrade the service will not lead to legal action by TPA Ventures. We do not run a paid bounty program; we thank researchers publicly, with their permission.
- security@ for reports and incidents
- security.txt with scope, contact and policy
- PGP key for encrypted reports
- Good-faith research protected by safe harbor
Looking for the agreements? Read the DPA and NDPA, the FERPA compliance statement and the subprocessor list.
Security questions districts ask
Do you train models on student data?
No. Student data is never used to train, fine-tune or evaluate models, whether ours or our providers'. Drafting runs in isolated inference under contracts that prohibit training on customer content, with zero retention by the model provider. The only copy of a prompt or output is the one logged for the district.
Where is data hosted?
In the United States only. Production runs in AWS us-east-1 with disaster recovery in us-west-2. No student data is stored or processed outside U.S. regions, including by our model providers.
Can we restrict which staff see which students?
Yes. Access is role-based and scoped. Case managers and related service providers see their own caseloads, principals see their building, directors and coordinators see the district, and a read-only auditor role exists for monitoring visits. Scope follows the rostering and identity source you already control.
What happens to data when we leave?
We return student data in a commonly used format and delete it within 60 days of contract end, or sooner at your written request, and send a certificate of deletion. The NDPA's Exhibit D lets you set the timing. Encrypted backups age out within 35 days after deletion.
Do you sign our state's privacy agreement?
Yes. We sign the SDPC National Data Privacy Agreement with your state's exhibits, state-specific forms such as the California Student Data Privacy Agreement, and addenda for New York Education Law § 2-d, Illinois SOPPA and similar laws. Districts in a state where another district has already signed can adopt that agreement through the General Offer of Terms.
How do you handle a breach?
We notify the affected district within 72 hours of confirming unauthorized access to its data, and sooner where state law requires. We share what was accessed, what we did about it and what we recommend, and we support the district's parent and state notifications. Breach terms are written into the NDPA and our state addenda.
Bring your security questionnaire. We have answered most of it already.
Our security team returns completed HECVAT and district questionnaires, the SOC 2 report and a signed NDPA, typically within 10 business days.