ConciergePad operates as a School Official under FERPA's school official exception. We only handle student data for the purposes our schools direct, never sell or share it for marketing, and contractually bind every vendor in our chain to the same standard.
These commitments are baked into our contracts, our infrastructure, and the way we operate every day.
ConciergePad is engaged by schools to perform functions the school would otherwise carry out internally. We operate under the school's direct control and use student data only for the contracted educational purposes.
We do not sell, rent, license, or share student data with third parties for advertising, marketing, or profiling purposes. We do not build profiles of students for any commercial purpose.
ConciergePad does not market to or interact directly with students. When the platform handles records on students under 13, we rely on the school's authority to consent on behalf of parents under FERPA's school official exception.
Our optional facial recognition is restricted to adults (staff, volunteers, approved guardians) and is 100% opt-in. We never apply facial recognition to minors. Adults who enrolled can request immediate, permanent deletion at any time.
Upon contract termination, all student data is returned to the school in a portable format or securely destroyed, per the school's direction. We provide written confirmation of deletion on request.
In the event of a confirmed breach affecting your data, we notify the school's designated data privacy contact promptly and in accordance with applicable state and federal law, with a follow-up containing scope, affected records, and remediation steps.
Below is a high-level overview of the categories of data ConciergePad may collect on behalf of a school, depending on which modules the school enables. A complete Schedule of Data, including specific fields, is provided to district data privacy officers as part of the executed Data Privacy Agreement.
Full field-level Schedule of Data available to district data privacy officers under DPA.
ConciergePad uses a limited set of established service providers in delivering our platform, all of which operate under written agreements with protections at least as strong as those in our school DPAs. The full named list, including current security attestations, is available to district data privacy officers on request.
All ConciergePad infrastructure is hosted with an established enterprise cloud provider in United States data centers. The provider holds current SOC 2, ISO 27001, and FedRAMP attestations.
Established email and SMS delivery providers handle school notifications and two-factor authentication codes. Each maintains current SOC 2 attestation.
Payment processing is handled by a PCI DSS Level 1 certified processor. Card data is never stored within ConciergePad systems.
When schools enable volunteer screening, results are provided by an established background check provider. ConciergePad receives only pass/fail eligibility codes.
Push notification delivery for our mobile apps is handled by an established provider with current SOC 2 attestation.
Edge security, content delivery, and DDoS mitigation are provided by a leading internet infrastructure company with current SOC 2 and ISO 27001 attestations.
Schools receive advance notice of material changes to our service provider list.
ConciergePad signs national and state-specific Data Privacy Agreements through the Student Data Privacy Consortium (SDPC) framework, as well as district-specific agreements when required.
Our default agreement for any district nationwide. Covers FERPA, COPPA, PPRA, and the common privacy obligations across SDPC state alliances.
For states with specific student privacy frameworks, including Utah, New York, California, Colorado, Illinois, Texas, and others, we sign the corresponding state-specific agreements or addenda.
If your district uses its own DPA template, we will review and counter-sign promptly. Most reviews complete quickly.
Beyond FERPA, every state has its own student data privacy laws. ConciergePad complies with applicable student data privacy laws in every state we operate in, including states with named statutes such as Utah, New York, California, Colorado, Illinois, Texas, Virginia, Connecticut, and others.
For state-specific compliance language, please reach out and we'll provide the appropriate addendum or state-specific DPA.
Under FERPA, parents and eligible students (18+) have specific rights regarding education records. Here's how ConciergePad supports those rights.
For operational and infrastructure security controls, see our Data Security page. Below are the privacy-specific commitments.
Every ConciergePad team member with access to school systems completes annual FERPA, COPPA, and information security training.
Production access to school data is reviewed on a regular basis. Access is granted on a least-privilege basis and logged. Departing personnel access is revoked promptly.
Any team member with potential access to student data is screened before being granted access. This includes contractors and consultants.
We maintain a written incident response plan with defined roles, escalation paths, and notification commitments.
Every service provider in our chain is reviewed for security posture and current attestations. Changes are disclosed to schools.
ConciergePad infrastructure and applications undergo external security testing. Findings are tracked to remediation with severity-based timelines.
Whether you're a district data privacy officer, a parent with a question, or a procurement team running due diligence, we want to hear from you.
Questions about our DPAs, service provider list, full Schedule of Data, or state-specific compliance? We respond promptly.
support@getconciergepad.com →Questions about your child's data should generally go to your school first, since they own the records. We're happy to help schools answer those questions.
support@getconciergepad.com →Need our security overview, vendor questionnaire responses, or to schedule a security review? Reach out and we'll get you what you need.
support@getconciergepad.com →If you've identified a privacy concern or have a media inquiry related to student data, please reach out before publishing. We'll engage in good faith.
support@getconciergepad.com →Send us the template your district uses or tell us which state you're in. We'll move quickly.
Request a DPA →