Privacy and Student Data
Supporting your FERPA and COPPA responsibilities
There is no such thing as FERPA-certified or COPPA-certified software. Compliance is how an institution uses its systems. What we can do is design the software so meeting your obligations is straightforward, and tell you exactly what it stores and who can see it.
Last reviewed: September 2026
What we never do
- We never receive your student data during normal operation. It stays on your server.
- We never sell student data, use it for advertising, or build profiles from it.
- We never use student data to train AI models. Atlas K-12's Compass assistant runs locally and does not learn from student records. See Compass AI.
Higher education: AtlasOA and FERPA
- Your institution remains in control of education records. AtlasOA runs on your infrastructure and your staff decide who has accounts.
- What AtlasOA stores: student identifiers and names from your imports, course sections and enrollments, rubric and assessment scores linked to outcomes, closing-the-loop records, and (if you use it) course evaluation responses and attachments your staff upload.
- Course evaluations are anonymous by design: responses are collected through single-use links and results for groups of fewer than five respondents are suppressed.
- Accreditation evidence packages contain aggregates only, not student identifiers.
- Access: role-based permissions and a tamper-evident audit log of changes. See Security.
- If we ever need access, for example to help with a support problem, our Data Processing Agreement treats AtlasOA, LLC as a school official with a legitimate educational interest under FERPA (34 CFR 99.31(a)(1)(i)(B)), limited to that purpose.
K-12: Atlas K-12, FERPA, and student privacy
- The district controls the data. Atlas K-12 runs on district infrastructure. AtlasOA, LLC acts as a service provider under the district's direction.
- No student accounts. Students never sign in to Atlas K-12.
- Demographics do not drive risk tiers. Automatic tier calculations use attendance, behavior, academics, and SEL data against thresholds your district sets; the whole-child pillars added in September 2026 are set by your student support team with a recorded reason. Race, ethnicity, disability, English learner, and income status are not inputs to the automatic calculation.
- State student-privacy laws vary. Our Data Processing Agreement is the starting point for your district's required agreement; we will review your state's standard agreement on request.
What Atlas K-12 stores
| Category | Examples |
|---|---|
| Student record | District and state ID, name, date of birth, school, grade, homeroom, enrollment status |
| Demographics | Gender, race and ethnicity, English learner status and language, IEP status and disability category, 504 plan, lunch status, and homeless, foster care, migrant, and military-connected flags |
| Academics | Assessment scores, course grades, report cards (uploaded files and grades) |
| Attendance and behavior | Attendance records with reason codes and notes; behavior incidents with description and action taken |
| Supports | Intervention plans, progress monitoring, referrals, Care Team meetings, and support notes (including counseling and health categories) |
| SEL | Survey answers on a 1 to 5 scale, stored per student (identified, not anonymous) so counselors can act on them |
| Tiers | Current tier by area and a history of tier changes with reasons |
| No dedicated fields | Social Security numbers, student home addresses, student or parent phone numbers, medications, or allergies. IEP disability category is stored with demographics, and health-related information can appear in health-category support notes and other free-text fields. |
Free-text fields (notes, incident descriptions, family communication notes) can contain anything staff type. Train staff on what belongs there.
Students under 13 and COPPA
- The only student-facing screen is an SEL survey opened from a signed link that expires after 14 days and works once. Students answer scale questions only; they do not create accounts, enter contact information, or see advertising.
- Schools commonly provide consent on parents' behalf for educational tools used solely for school purposes. Whether your district's SEL survey practice needs parental notice or consent is a decision for your district and counsel.
- Parents can opt a student out of SEL surveys; staff record the opt-out under SEL Surveys, and the survey will not open for that student.
Who can see sensitive data
- District administrators see every school. Building administrators, counselors, and teachers see students at their assigned school, including teachers seeing students beyond their own classes.
- SEL results, Smart Groups, and Care Team management are limited to counselors, administrators, and MTSS Coordinators.
- Support notes marked restricted are visible only to counselors and administrators.
- Care Team records follow the same school-level rule as the student. Care Team membership neither adds nor restricts access.
- Student profile views, report card downloads, and roster exports are recorded in the audit log.
Requests from students and families
Requests to inspect, amend, or delete education records go to your institution, which holds the data. Your staff can view and correct records in the application. Deleting or anonymizing a student's records is not yet an in-app feature in either product; your IT staff can do it in the database, and we will help. See Known limitations.
Privacy documents
- Data Processing Agreement: available for institutional review.
- Privacy policy, terms, and license agreements: see the Procurement Center.
- Subprocessors and outside services
Do not take our word for it. Test it yourself. Install AtlasOA or Atlas K-12 on a machine your institution controls, use sample or non-production data, and let your own people decide.