Why we don’t claim to “be FERPA compliant”
Because no software company can be. FERPA places obligations on schools, not on vendors. There is no FERPA certification, no FERPA audit and no FERPA registry. A vendor advertising itself as “FERPA compliant” is describing a status that does not exist.
What FERPA does provide is the school official exception: a school may share student records with an outside party performing a service it would otherwise do itself, provided that party is under the school’s direct control and uses the records only for that purpose. Your school makes that determination. Our job is to make sure that when they look, everything they need is there.
What we have built for it
Each of these is a capability in the product, not a policy statement:
| What FERPA review asks | What SuperGrader does |
|---|---|
| Records used only for the stated purpose | Uploaded work is graded for the teacher who uploaded it. It is never sold, never used for advertising, and never used to train AI models. |
| Records not redisclosed without authorisation | Every party that receives data is named in the Privacy Policy. There are no undisclosed recipients. |
| The school can direct deletion | A teacher can delete any single grade, any assessment, or their entire account and everything in it, at any time and without contacting us. |
| Records can be produced on request | Grades export to CSV and PDF, so a teacher can hand records to their school or respond to a parent inspection request. |
| Records are protected in storage | Encrypted in transit and at rest, and student names and grading details are encrypted again inside our database, so database access alone does not reveal them. |
| Access is controlled and attributable | Uploaded papers are private to the uploading account and served only through short-lived signed links. Sign-ins, deletions and administrative actions are recorded in a server-side audit trail. |
| Sessions can’t be left open | Accounts sign out automatically after inactivity, so an unattended classroom machine does not stay logged in. |
| Retention is bounded | Nothing is kept beyond what the teacher keeps. A fixed retention period can be enabled for an account on request. |
What your school still has to do
Two things are genuinely outside our control, and we would rather be direct about them than let you find out during an audit.
- 1Designate us.Only your school or district can decide that SuperGrader is a school official with a legitimate educational interest. Signing up as an individual teacher does not make that decision — you cannot make it on your employer’s behalf, and we cannot make it for you.
- 2Check your own policy first. Many districts require software handling student work to be reviewed before use, and a growing number restrict sending student work to third-party AI services at all. Grading with SuperGrader means identifiable student work is processed by an AI provider. If that is not permitted where you teach, this tool is not the right one, and we would rather you knew now.
If your district needs a written agreement in order to designate us, contact us and we will provide one. If they need to interrogate the AI side specifically, our AI Transparency page answers the eight questions they are most likely to ask — including the two where our answer is not the comfortable one.
In one sentence
We have built SuperGrader so that a teacher whose school has approved it can use it in a FERPA-compliant way — and we have documented everything a school needs in order to decide whether to approve it.
This page describes how the product works. It is not legal advice, and it is not a substitute for your district’s own review. Questions from a school administrator: privacy@supergrader.app