AmplifyED Coaching portal logoAmplifyED Help
SearchSign in

FERPA overview (procurement)

Last updated 2026-06-08

View raw markdown

At a glance

  • Who uses it: District IT, legal, and DPO reviewers vetting AmplifyED.
  • Purpose: Procurement-ready summary of how AmplifyED supports FERPA obligations.

Summary

AmplifyED is a FERPA-conscious academic coaching workspace. Schools and districts remain the data controllers for student education records; AmplifyED is the processor. Our platform is designed so the school can demonstrate the access controls, audit trail, and retention behavior FERPA expects.

Designed for FERPA

  • Role-based access: District admin, school admin, facilitator, teacher — each scoped to the records they need. Multi-tenant isolation is enforced at the database level using Postgres row-level security on organization_id.
  • Need-to-know visibility: Teachers see only their own students; facilitators see only their assigned caseload; admins see only their own school.
  • Audit logging: Every sensitive action — role change, record access, export, login failure — is recorded with actor, timestamp, IP, and user agent. See Audit logging.
  • Configurable retention: Each org sets case retention in years (1–25). See Data retention & deletion.
  • Customer-controlled exports: One-click FERPA-formatted student dossier exports (PDF + CSV in a ZIP). See Data ownership & exports.

What the school remains responsible for

FERPA places obligations on the educational institution that no vendor can take over:

  • Granting access only to staff with a legitimate educational interest.
  • Notifying parents of their rights under FERPA.
  • Handling parent requests for inspection and amendment of records.
  • Maintaining the institution's record of disclosures.

AmplifyED gives you the tooling (roles, audit log, exports) to do these things consistently — it cannot perform them on the school's behalf.

Subprocessors

A current list of subprocessors is maintained at Subprocessors. Changes are announced in advance.

Data location

Production data is hosted in the United States. We do not transfer student education records outside the US.

AI and student data

If your district opts in to AI features, no student data is used to train any underlying model. See AI & student data.

Related articles

FAQ

Can we sign a Data Privacy Agreement (DPA)? Yes. Email security@amplifyed.app to request the current DPA or to submit a district-specific addendum.

Are you SDPC / NDPA signatories? We support the National Data Privacy Agreement (NDPA) framework. Contact us for the current signed exhibit.

Related