Procurement FAQ

At a glance

Who uses it: Procurement, legal, IT security, and DPO reviewers.
Purpose: Fast answers to the most common procurement questions in one page, with links to the detailed articles.

Compliance & data

Is AmplifyED FERPA-conscious? Yes — see FERPA overview. The school remains the data controller; AmplifyED is the processor.

Where is data hosted? Production data is hosted in the United States. No student data is transferred outside the US.

Will you sign a Data Privacy Agreement (DPA / NDPA)? Yes. Email security@amplifyed.app for the current signed templates.

Who are your subprocessors? See Subprocessors. 30-day advance notice on changes.

Do you support customer-managed encryption keys (BYOK)? Not today. All keys are managed by AmplifyED's KMS.

Authentication & access

Do you support SSO? Yes — Google Workspace, Microsoft Entra ID, Okta, OneLogin, ADFS, and generic SAML 2.0. See Identity & SSO.

Do you support SCIM provisioning? SCIM 2.0 is on the roadmap. Today: JIT provisioning on verified domains plus direct admin deactivation.

Do you support MFA? MFA is enforced by your IdP for SSO sign-ins. Native MFA for email + password is on the roadmap.

How are sessions secured? HTTP-only cookies, tokens rotate on sign-in, configurable session length, idle timeout, account lockout after 3 failed sign-ins.

Security & audit

Do you have an audit log? Yes — every sensitive action is recorded with actor, timestamp, IP, user agent. Retained 7 years. See Audit logging.

Do you have SOC 2? SOC 2 Type II is in progress; status available under NDA.

Where do I report a vulnerability? security@amplifyed.app — see Vulnerability reporting.

Do you have an incident response process with notification SLAs? Yes — 24-hour customer notification for incidents affecting customer data. See Incident response.

AI

Do you use AI? With student data? AI features are opt-in. When opted in, case text is sent to a managed AI gateway (US region, Google Gemini 3 Flash Preview). No customer data is used to train the underlying model. Every AI output is a draft until a human accepts it. See AI & student data.

Data ownership & exit

Do we own our data? Yes. See Data ownership & exports.

Can we export everything if we leave? Yes — a bulk export package is delivered during the grace period of the contract. Retention deletion follows your configured policy or the termination addendum, whichever is shorter. See Data retention & deletion.

Pricing & contracting

How is pricing structured? Per-school subscription with optional add-ons for additional students-receiving-support, teacher portal seats, facilitator seats, and AI drafts. Annual plans include a multi-month discount. See Billing & plans.

Do you accept purchase orders? Yes, on annual plans. Contact billing@amplifyed.app.