Vendor compliance summary

The answers a district privacy reviewer, an AI committee, or a purchasing co-op application asks for — in one page, written to be printed and attached to a file.

Last reviewed July 2026. AdaptEd is operated by a single Texas-based developer.

Read this first. AdaptEd is a small, independently operated product. Several things a large vendor would list here do not exist, and they are stated plainly in “What we do not have” below rather than omitted. If a claim on this page and the product ever disagree, the product is wrong and we want to hear about it.

1. What the product is

A teacher authors a lesson; students work it; the system records which state standard each student demonstrated and drafts targeted reteaching. It is supplemental instructional software. It is not a student information system, not a screening instrument, and not on any state eligibility list.

2. Student data we hold

Category	What it is
Identity	Name, email, and (where a district provides it) a local student ID used to match roster imports.
Roster	Class enrolment, teacher of record, and educational designations a teacher records (for example ELL status and proficiency level, and accommodation flags).
Academic work	Answers submitted to lesson questions, timing, per-standard mastery results, and the evidence record behind them.
Account	Authentication data managed by ASP.NET Identity; passwords are stored as salted hashes, never in plain text.

We do not collect biometric data, precise location, browsing history outside the product, or advertising identifiers. There is no advertising in the product and student data is never sold or used to build advertising profiles.

3. Statutory posture

Framework	How it's handled
FERPA	We act as a school official with a legitimate educational interest, under the district's direct control. Education-record access is logged with the accessing user, record type, stated purpose, timestamp and IP address. Consent state is recorded per user.
COPPA	Under-13 accounts require verifiable parental consent before use. Consent can be completed by emailed verification link or by uploading a signed paper form. Consent requests are reviewable and revocable by an administrator.
Texas Education Code ch. 32 (SB 820 / operator duties)	We act as an “operator” of a school-service product: student data is used only to provide the service, is not sold, and is deleted on district or parent request (see §5).
Texas HB 149 (TRAIGA) & 1 TAC ch. 219	AI features are disclosed rather than hidden: a teacher reviews and approves AI-drafted lessons before students see them, AI-drafted reteach content sits in a review queue, and the AI tutor can be switched off per lesson. Scoring for the deterministic question types is computed on the server by fixed rules with no language model in the path.
State privacy laws	Compliance status is tracked per user for California (SOPIPA), New York (Education Law 2-d), and Illinois (SOPPA), with an audit trail of compliance actions.
CIPA	Content safety approach is described at Content Safety. Network-level filtering remains the district's responsibility.

4. Sub-processors

These are the external services that receive data in the course of providing the product.

Provider	Purpose	What reaches them
OpenAI	Lesson, question and teaching-material generation; open-response scoring on paid tiers	Teacher-authored prompts and content; student written responses where AI scoring is used
Google (Gemini)	Lesson generation and media analysis	Teacher-authored prompts and content
Google Cloud Text-to-Speech	Read-aloud accommodation	Lesson and question text (not student answers)
Google Cloud Vision	Optical character recognition on uploaded documents	Documents a teacher uploads
Google Workspace / Classroom APIs	Sign-in, roster import, grade pass-back	Account identity, roster, grades
Stripe	Subscription billing	Teacher/purchaser billing identity only — no student data
Email (SMTP)	Account, consent and notification email	Recipient address and message content
Microsoft SQL Server (hosted)	Application database and background-job storage	All application data
YouTube, Pexels	Optional media search when a teacher adds media	Search terms only

Model providers are used to generate and score content. We do not submit student data for the purpose of training third-party models, and we do not operate our own model training. Public web fonts and script CDNs are used for front-end assets; a district that requires zero third-party asset loading should raise it with us before deployment.

5. Deletion, retention and legal hold

How data is deleted

Anyone — a parent, student, or district staff member — can submit an access or deletion request at Data Requests. Requests are recorded and worked from an administrative queue; the notification email deliberately contains no requester details.
A teacher or account holder can export their own data from their profile.
An administrator can execute a verified purge of an individual student's data, and can export a student's full record for portability.

Retention controls

A configurable retention and archive policy governs how long class data is kept.
A class purge can be previewed as a dry run showing exactly what would be destroyed, then scheduled, then cancelled while pending. Immediate purge requires typing a confirmation phrase.
Every executed purge is recorded as a purge run.
Legal hold can be placed on a class with a reason and an expiry, and blocks purging until it is cleared.

6. Access control and audit

Role-based access (student, teacher, campus leadership, administrator), with teacher access scoped to their own classes and content.
Three independent audit trails: education-record access (FERPA), accommodation-tool usage with start/end timestamps, and state-compliance actions.
Accommodation assignments carry a full grant/revoke history with the granting user, justification, and an optional IEP/ARD reference code — and export as an ARD-ready usage report.
Authentication via ASP.NET Identity. HTTPS enforced. Security headers set at the application level. The background-job dashboard is authorization-gated.

7. What we do not have

Stated plainly, because a reviewer who catches one overstatement is right to discount the rest of the page.

No	SOC 2 report. No Type I and no Type II.
No	Third-party penetration test or external security audit.
No	ISO 27001 or equivalent certification.
No	Documented breach-notification workflow. Notification obligations would be met, but the runbook is not written down.
No	Data-residency guarantees or customer-managed encryption keys.
No	SSO/SCIM automated deprovisioning tied to retention.
No	Efficacy study. The evidence base is a logic model — ESSA Tier 4. See How We Measure Mastery.
No	Localized interface. Lessons can be generated in Spanish or bilingually; the application's own menus and dashboards are English only.

A district that requires any of the above as a precondition should treat AdaptEd as not yet meeting its bar, and we would rather say so here than in month three of a deployment.

8. Contracting

A Data Processing Agreement based on the Student Data Privacy Consortium framework is available on request. AdaptEd is purchasable by purchase order with Net-30 invoicing. Contact support@adaptedquest.com for the DPA, a completed vendor questionnaire, or a security review call.