AI & FERPA data handling

Purpose

Explain exactly what data leaves AmplifyED when AI features are used, and what protections apply.

The short version

AI features are opt-in at the org level.
No student PII is sent to the model. Names and identifiers are masked before the request leaves AmplifyED.
The provider does not train on prompts. Contractual zero-retention is in place.
Every AI request is audit-logged.
Output is never auto-saved — a human must review and click Save.

What gets sent

Field	Sent to model?
Student name	No (masked)
Student ID	No
Date of birth	No
Concern type (e.g. "academic")	Yes
Intervention type	Yes
Your typed bullets / prompt	Yes
Existing case notes	Only if you explicitly opt in for a summary

Providers

AmplifyED uses managed AI through the Lovable AI Gateway, which routes to enterprise-tier APIs at OpenAI and Google. Both contractually do not train on inputs. See Subprocessors for the current list.

Turning AI off

Administration → AI features → Disable. AI buttons and panels disappear across the product. No backfill or data loss — saved notes remain unchanged.

FAQ

What if a teacher includes a student's name in their typed prompt? The masking pass runs before the request leaves AmplifyED. The model receives <student>, not the real name. The original prompt remains in your audit log.

Are AI prompts retained by the provider? No — zero-retention is configured. See Subprocessors.

Can I see what prompts were sent on behalf of my school? Yes — Administration → AI activity log. Admin-only.