---
title: FERPA overview (procurement)
category: procurement
order: 1
lastUpdated: 2026-06-08
featureAvailability: GA
roles: [district-admin, admin]
relatedArticles: [security/ferpa-overview, procurement/data-retention-deletion, procurement/data-ownership-exports, procurement/audit-logging]
---

## At a glance

- **Who uses it:** District IT, legal, and DPO reviewers vetting AmplifyED.
- **Purpose:** Procurement-ready summary of how AmplifyED supports FERPA obligations.

## Summary

AmplifyED is a FERPA-conscious academic coaching workspace. Schools and districts remain the data controllers for student education records; AmplifyED is the processor. Our platform is designed so the school can demonstrate the access controls, audit trail, and retention behavior FERPA expects.

## Designed for FERPA

- **Role-based access**: District admin, school admin, facilitator, teacher — each scoped to the records they need. Multi-tenant isolation is enforced at the database level using Postgres row-level security on `organization_id`.
- **Need-to-know visibility**: Teachers see only their own students; facilitators see only their assigned caseload; admins see only their own school.
- **Audit logging**: Every sensitive action — role change, record access, export, login failure — is recorded with actor, timestamp, IP, and user agent. See [Audit logging](/help/procurement/audit-logging).
- **Configurable retention**: Each org sets case retention in years (1–25). See [Data retention & deletion](/help/procurement/data-retention-deletion).
- **Customer-controlled exports**: One-click FERPA-formatted student dossier exports (PDF + CSV in a ZIP). See [Data ownership & exports](/help/procurement/data-ownership-exports).

## What the school remains responsible for

FERPA places obligations on the educational institution that no vendor can take over:

- Granting access only to staff with a legitimate educational interest.
- Notifying parents of their rights under FERPA.
- Handling parent requests for inspection and amendment of records.
- Maintaining the institution's record of disclosures.

AmplifyED gives you the tooling (roles, audit log, exports) to do these things consistently — it cannot perform them on the school's behalf.

## Subprocessors

A current list of subprocessors is maintained at [Subprocessors](/help/procurement/subprocessors). Changes are announced in advance.

## Data location

Production data is hosted in the United States. We do not transfer student education records outside the US.

## AI and student data

If your district opts in to AI features, no student data is used to train any underlying model. See [AI & student data](/help/procurement/ai-student-data).

## Related articles

- [FERPA in AmplifyED (operational)](/help/security/ferpa-overview)
- [Data retention & deletion](/help/procurement/data-retention-deletion)
- [Data ownership & exports](/help/procurement/data-ownership-exports)
- [Audit logging](/help/procurement/audit-logging)
- [Security overview](/help/procurement/security-overview)
- [Subprocessors](/help/procurement/subprocessors)

## FAQ

**Can we sign a Data Privacy Agreement (DPA)?**
Yes. Email security@amplifyed.app to request the current DPA or to submit a district-specific addendum.

**Are you SDPC / NDPA signatories?**
We support the National Data Privacy Agreement (NDPA) framework. Contact us for the current signed exhibit.