FERPA compliance
How GradingPen supports FERPA-aligned handling of student essays and grading data.
Summary
The Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. GradingPen is designed so that teachers and schools can use AI-assisted grading while maintaining FERPA-aligned practices.
We act as a school official with a legitimate educational interest when a district engages us, and as a direct service to teachers when individual educators sign up on their own.
What we do
- No training on your data. Essays you upload are used to generate a grade for you and are not used to train third-party models.
- Encryption in transit. All traffic to and from gradingpen.com is served over HTTPS/TLS 1.2+.
- Encryption at rest. Data is stored in an encrypted database (Supabase / PostgreSQL) with per-record access controls.
- Minimum necessary data. We only collect what's needed to grade essays (essay text, teacher account, optional student name/ID for your own records).
- Access controls. Row-level security ensures only the authenticated teacher who created a record can read or modify it.
- Deletion on request. You can delete assignments, students, and your entire account from the dashboard; email us for a signed deletion attestation.
Recommended teacher practices
- Use student initials or class IDs instead of full names when possible.
- Don't paste sensitive identifiers (SSNs, dates of birth, home addresses) into essays.
- Confirm with your district whether individual-teacher use requires prior approval.
For schools & districts
We can sign a Data Privacy Agreement (DPA) covering FERPA, COPPA, and state-level laws (e.g., NY Ed Law §2-d, California SOPIPA). Email legal@gradingpen.com to request the current DPA.