The school official exception, and what it obliges a vendor to build
In short
A vendor may hold education records because the institution designates it a school official performing a service the school would otherwise do itself, under the school's direct control over how records are used and kept. Each condition of that permission converts into system work: scoped configuration, purpose tags, redisclosure control and provable deletion.
Key takeaways
- The statutory duty is the institution's. Your job is to make it satisfiable and cheap to evidence.
- Direct control means the school configures scope, retention and access — not that you configure them for it.
- Use limitation is only real when a purpose tag travels with the query and the data layer refuses without one.
- Every downstream processor is a redisclosure question, including the hosted inference endpoint a feature calls.
- Deletion counts when you show it reached indexes, caches, backups and device copies, with a dated receipt.
A vendor holds education records lawfully because the institution has designated it a school official with a legitimate educational interest: it performs a service the school would otherwise use staff for, under the school's direct control over the use and maintenance of those records. Every clause of that is something a review will ask you to demonstrate in software.
This is an engineering reading of FERPA, not legal advice, and the institution's counsel owns the edges. BuildspaceLabs holds no privacy or security certifications, so where procurement wants an audited badge before a supplier touches student data, weigh that at shortlist stage, not after a 6-week pilot.
The conditions, converted into things you have to build
Read left to right, each condition is a feature request with an evidence requirement attached.
| Condition | What the school asserts | What you build | Evidence a review asks for |
|---|---|---|---|
| Performs an institutional service | You do work staff would otherwise do | A feature set bounded by the named service | A feature-to-service map matching the contract |
| Direct control over use and maintenance | The school directs how records are used and kept | Per-tenant settings for scope, retention and access | Admin screens plus a change log naming who changed what |
| Used only for the disclosed purpose | The data serves this service and no other | A purpose tag on every read path, refused when absent | Query logs carrying purpose, and 1 denied example |
| No redisclosure without authorisation | Nothing flows onward uncontrolled | A sub-processor register and 1 export chokepoint | Dated sub-processor list; inventory of export routes |
| Access limited to legitimate interest | Officials see only records they need | Role plus scope from current enrolment, recomputed each term | Access matrix and a 30-day sample of access logs |
Use limitation is a tag on the query, not a line in a policy
Purpose becomes enforceable only when it travels with the request and the data layer can refuse. Every read of a student record carries a value from a closed list, the repository rejects a query without one, and the value lands in the access log beside the actor.
- Keep the list to 5 or 6 school-legible values: advising, assessment, attendance, support, billing. A purpose you cannot explain to a registrar in 1 sentence will not survive a review.
- Ban the catch-all. The day 'general' exists, every code path uses it and the tag carries no information.
- Tag derived stores too. A vector index built from advising notes inherits its source's purpose, which is the sort of rule we push into the data model during internal tools and ops work.
- Collect only what the purpose needs. Where age decides what may be held at all, that belongs upstream in an age gate that does not collect a birthday.
Redisclosure control is a register plus one chokepoint
Routes out of a system are rarely inventoried: a hosted inference API, an analytics SDK, an email provider rendering a student name into a template, a support tool where a screenshot lands, a partner integration switched on for 1 district. Each is a party receiving education records, and each needs the school's authorisation.
Deletion the school can verify, not deletion you assert
- Enumerate every store holding a copy: primary tables, search and vector indexes, caches, object storage, logs, the analytics warehouse, backups, and device copies — offline material is a real copy, as making lesson material work with no signal sets out.
- Define deletion per store. Backups expire rather than get surgically edited, so state the maximum residency — 35 days is a common cycle — and have the school accept it in writing.
- Give the school a delete instruction it can issue itself, scoped to 1 student, a cohort or the whole tenancy, returning a dated receipt.
- Verify afterwards and keep the result. 'The job exited 0' is not evidence; '0 rows matched across 11 stores at 03:14' is.
- Re-run the sweep after the next roster sync, because an SIS reinstates deleted students more often than teams expect.
Who is actually obliged, and what that means for a roadmap
The statutory duty sits with the institution. No vendor is compliant with FERPA in its own right, and a supplier claiming to be is describing a contract rather than a certification anyone issues. What a vendor can do is make the institution's compliance achievable and cheap to evidence — which is what a security questionnaire tests when it asks for screenshots of an admin screen.
So the roadmap question is which clauses you already satisfy and which need code that does not exist yet — the exercise in reading a school data agreement clause by clause. This silo sits under student data privacy, engineered, inside our education and edtech work.
Frequently asked questions
Short answers to the follow-ups this page tends to raise.
Does a software vendor need to be FERPA compliant?
No supplier is FERPA-compliant in its own right, because the statute binds institutions rather than vendors. A vendor operates inside the school's permission as a designated school official, and its duties arrive through the contract: use records only for the contracted service, restrict onward disclosure, and delete on instruction.
What does direct control actually mean for a product?
It means the school decides how records are used and kept, so those decisions must be configuration rather than code. Retention periods, which roles see which records, which fields a feature may read and whether an integration is enabled all belong in per-tenant settings the school can change, with a log of who changed what.
Can we use student data to improve our own product?
Not under this exception, which permits use only for the purpose the disclosure was made for. Product improvement is a different purpose needing separate authorisation, and most district agreements refuse it outright. Aggregate analysis is the usual path, and it holds only if re-identification is genuinely infeasible at your cohort sizes.
Does calling a hosted model API count as redisclosure?
Yes, where identifiable student content leaves your systems to reach it. The provider becomes a party processing education records, so it belongs on the sub-processor register with region and retention terms, and the school must have authorised that category of disclosure. Stripping identifiers first helps only if the stripping is verified.
- FERPA
- edtech
- vendor obligations
- privacy engineering
The work behind this page
Builds from our portfolio that this page draws on.
AskVault
An AI internal knowledge-search platform that answers employee questions from your own docs — grounded in citations, with knowledge gaps surfaced and deflection tracked.
Productivity AINotewell
An AI meeting assistant that records and transcribes every meeting, extracts the decisions and action items, assigns owners and due dates, and tracks follow-through until it's done.
Productivity AIRead next
- Where the education record starts and stops, in the schemaThe education record is not a system boundary you can draw around one database. It is a property of fields, which is why transcripts, prompt logs, error payloads and backups keep landing inside it.definition
- A student data privacy agreement, read as an engineering specificationSchools bind vendors with a standard agreement plus an exhibit naming every data element collected. Five of its clauses are build work, and the exhibit is a schema diff in disguise.definition
- Directory information is a per-student flag your code has to honourSchools designate their own directory information list, and any family can opt out mid-year. That makes it a dated per-student flag every outbound surface reads at render time.definition
- Verifiable parental consent, and when the school can give it insteadUnder COPPA, consent must be obtained by a method reasonably likely to prove it came from a parent. Schools can stand in for parents in narrow classroom cases, and the deliverable is a consent record.definition
Working on something in this space?
Tell us where you are in a sentence or two. We'll tell you honestly whether we're the right team, and what a sensible first slice of the work looks like.
Start the conversation