Student work deserves more than a generic promise of privacy. It deserves concrete controls: who can see a record, why they can see it, how long it remains available, and what happens when a school needs to review, export, correct, or remove it.<\/p>\n\n\n\n
That is the approach we take at Innovation Assessments. Our platform is designed to support schools as they meet their responsibilities under the Family Educational Rights and Privacy Act (FERPA) and other applicable student-privacy requirements.<\/p>\n\n\n\n
An important distinction comes first: FERPA applies to educational agencies and institutions that receive applicable U.S. Department of Education funding. There is no U.S. Department of Education \u201cFERPA certification\u201d for an education-technology product, and adopting any single tool does not make a school automatically compliant. Schools remain responsible for their notices, policies, permissions, contracts, and decisions about legitimate educational interest. Our responsibility is to provide careful product controls, transparent practices, and contractual commitments that help them do that work.<\/p>\n\n\n\n
Access follows the classroom relationship<\/strong><\/p>\n\n\n\n Innovation Assessments organizes access around authenticated users, educational roles, courses, and active enrollment.<\/p>\n\n\n\n Students can access assigned activities only when they are actively enrolled and the relevant course and task are available. Teachers control visibility, admissions and readmissions, and secure-assessment settings. Teacher views constrain classroom information by course ownership and the relevant student or activity. When a teacher authorizes another staff member, access is explicit and revocable; invitations expire and their secret tokens are stored in hashed form.<\/p>\n\n\n\n These safeguards reflect a central FERPA expectation: education records should be available only to people with a legitimate educational interest. The school defines that interest; our platform supplies technical boundaries that help put it into practice.<\/p>\n\n\n\n Educators remain in control<\/strong><\/p>\n\n\n\n Teachers decide when a course or activity is visible, who is enrolled, which staff members are authorized, and how an assessment is configured. Across the platform, educators can review student work, scores, participation records, and\u2014in secure activities\u2014relevant proctoring context.<\/p>\n\n\n\n Export and deletion tools help schools respond to their own record-management obligations. Because parent and eligible-student requests are handled through the educational institution, we work with the school rather than bypassing its established identity-verification and records procedures.<\/p>\n\n\n\n We keep data for defined periods\u2014not simply forever<\/strong><\/p>\n\n\n\n Keeping information indefinitely creates unnecessary privacy risk. Innovation Assessments defines limited retention windows for major categories of classroom data. Many student submissions, scores, discussions, chats, notifications, and audio\/video responses are scheduled for removal after nine months of inactivity. Proctoring, audit, secure-browser, and teacher AI-usage logs use a shorter six-month window.<\/p>\n\n\n\n Retention can also be affected by a school’s valid preservation request or legal obligation. We continue to review our deletion coverage as the platform evolves, including related attachments and downstream service providers.<\/p>\n\n\n\n Security is layered<\/strong><\/p>\n\n\n\n No single control protects a student record. Our application uses layers that include authenticated sessions, role and ownership checks, active-enrollment checks, prepared database operations, output encoding, anti-forgery protection on sensitive administrative actions, expiring invitation tokens, per-attempt secure-assessment tokens, and teacher two-factor approval.<\/p>\n\n\n\n We also maintain audit and proctoring records for defined periods so authorized educators can understand relevant activity. Those records are treated as sensitive educational context\u2014not as automatic proof of misconduct. Human review matters, particularly because browser and focus events can have innocent explanations, including accessibility tools and ordinary device behavior.<\/p>\n\n\n\n FERPA does not prescribe one technical security checklist. The U.S. Department of Education nevertheless encourages schools and their providers to take appropriate steps to safeguard student records, and we treat that as an ongoing engineering responsibility.<\/p>\n\n\n\n AI has a defined educational purpose and requires educator judgment<\/strong><\/p>\n\n\n\n Innovation Assessments offers optional AI-assisted features for tasks such as instructional-content generation, response summaries, language analysis, scoring assistance, and analysis of assessment activity. These features are invoked for a defined educational purpose; they are not a license to use student work for unrelated purposes.<\/p>\n\n\n\n Some workflows can redact student names before analysis, and we are working to make data minimization consistent across AI-enabled features. When an AI feature assists with scoring or review, its output is an aid to the educator\u2014not a substitute for professional judgment. Our privacy documentation identifies relevant service providers, and our agreements and configurations are intended to restrict data use to providing the requested service.<\/p>\n\n\n\n Schools should evaluate optional AI features under their own policies and applicable state and local requirements. We welcome that review and aim to provide the information administrators need to make an informed choice.<\/p>\n\n\n\n Privacy is a continuing practice<\/strong><\/p>\n\n\n\n Student privacy is not a badge awarded once. It is a continuing discipline spanning product design, contracts, retention, access review, incident response, staff training, and honest communication.<\/p>\n\n\n\n We regularly review our code and practices through that lens. We also give schools a clear path to ask questions about data handling, request relevant privacy documentation, and coordinate record access or deletion.<\/p>\n\n\n\n For details, please review our Privacy Policy (https:\/\/innovationassessments.com\/innov-privacy-policy.html<\/a>) and contact us through our published support channel. School and district administrators may also request our data-processing terms and current subprocessor information.<\/p>\n\n\n\n For authoritative information about FERPA, visit the U.S. Department of Education’s Student Privacy Policy Office (https:\/\/studentprivacy.ed.gov\/ferpa<\/a>) and its guidance on data security for K\u201312 and higher education (https:\/\/studentprivacy.ed.gov\/data-security-k-12-and-higher-education<\/a>).<\/p>\n\n\n\n *This article describes product design and company practices. It is not legal advice, does not create a certification or warranty, and does not replace a school’s own FERPA analysis.*<\/em><\/p>\n","protected":false},"excerpt":{"rendered":" Student work deserves more than a generic promise of privacy. It deserves concrete controls: who can see a record, why they can see it, how long it remains available, and what happens when a school needs to review, export, correct, or remove it. That is the approach we take at Innovation Assessments. Our platform is … Continue reading “Student privacy by design: how Innovation Assessments supports schools’ FERPA responsibilities”<\/span><\/a><\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8,6],"tags":[],"class_list":["post-1233","post","type-post","status-publish","format-standard","hentry","category-innovation-apps","category-learning-in-digital-environment"],"_links":{"self":[{"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/posts\/1233","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/comments?post=1233"}],"version-history":[{"count":1,"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/posts\/1233\/revisions"}],"predecessor-version":[{"id":1234,"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/posts\/1233\/revisions\/1234"}],"wp:attachment":[{"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/media?parent=1233"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/categories?post=1233"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.innovationassessments.com\/blog\/wp-json\/wp\/v2\/tags?post=1233"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}