FERPA Compliance

StudySite operates as a school official under FERPA (20 U.S.C. § 1232g; 34 CFR Part 99) when contracted by an educational institution. We treat student education records with the same care the institution would directly.

Our role

• We process student records (assignments, submissions, chat sessions) only on behalf of the contracting institution.
• We do not sell student data, do not use it for advertising, and do not use it to train third-party AI models.
• We honor the institution's instruction to delete records on request, within 30 days unless legally required to retain.

Access controls

• Students see only their own records.
• Instructors see records for students enrolled in sections they own.
• Administrators have system-wide access for support and audit purposes only.
• Every sensitive operation is logged in our audit trail.

Subprocessors that receive student data

• Render.com — application hosting + Postgres database.
• Cloudflare R2 — file storage (textbook archives, agent-template files).
• Anthropic / OpenAI — only when an instructor explicitly enables AI features that send chat content.

See our full sub-processor list for details on what each receives.

Parental rights

For students under 18, parents/guardians can request access to their student's records through the contracting institution.

Contact

FERPA-specific inquiries: admin@studysite.aiwith “FERPA” in the subject line.