FERPA Compliance Statement — TrackEDU
Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 CFR Part 99)
Document version: 1.0
Effective date: May 9, 2026
Prepared by: Ravlo, LLC (operator of TrackEDU)
1. Overview
This document describes how TrackEDU, a product of Ravlo, LLC, is designed and operated to comply with the Family Educational Rights and Privacy Act (FERPA). FERPA is a federal law that protects the privacy of student education records and grants parents and eligible students specific rights with respect to those records. TrackEDU is a multi-tenant, software-as-a-service (SaaS) platform used by K–12 school districts to track student behavior, support MTSS/PBIS frameworks, manage interventions, and support student success.
TrackEDU operates under FERPA as a school official with a legitimate educational interest — a designation applicable to third-party contractors that perform institutional services for educational agencies and institutions under 34 CFR § 99.31(a)(1). Districts using TrackEDU retain ownership of all student education records. Ravlo, LLC acts solely as a data processor on behalf of each contracting district.
2. Education Records Held
TrackEDU stores and processes the following categories of student education records on behalf of contracting school districts:
2.1 Directory-Eligible Information
- First name, last name
- School and classroom enrollment
- Grade level
- Student ID number
2.2 Behavioral and Disciplinary Records
- Behavior incident reports (type, severity, location, description, date/time, resolution)
- Incident triggers and actions taken
- Behavior level and trend data
- MTSS/PBIS tier assignments and tier assignment history
- Intervention plans and progress notes
- Fidelity check records
2.3 Special Education Records
- IEP (Individualized Education Program) status, category, notes, and date ranges
- BIP (Behavior Intervention Plan) status, category, notes, and date ranges
- BSP (Behavior Support Plan) status, category, notes, and date ranges
- Student plans and associated documents (uploaded PDF/files)
2.4 Health and Medical Records
- Allergies, dietary restrictions
- Medications
- Medical conditions and medical notes
2.5 Demographic and Socioeconomic Records
- Date of birth, gender, race/ethnicity
- Primary and secondary languages
- Foster care status and notes
- Homeless/McKinney-Vento status and notes
- Living situation and notes
- Grade retention history
2.6 Attendance Records
- Attendance dates, statuses, and notes recorded by staff
2.7 Staff and Guardian Records
- Staff profiles (name, email, role, school/district assignment)
- Guardian profiles and their relationship to students (primary guardian, pickup authorization)
3. Parental Rights Under FERPA
FERPA grants parents (and eligible students aged 18 or older) the following rights. TrackEDU provides the technical mechanisms for districts to fulfill each right:
3.1 Right to Inspect and Review Records
Parents and eligible students have the right to inspect and review the student's education records within 45 days of a written request to the school.
TrackEDU Implementation:
TrackEDU includes a formal Data Access Request workflow (stored in the data_access_requests table) through which parents, eligible students, or their legal representatives may submit requests for specific record types, including:
- All records
- Academic records
- Disciplinary records
- Health records
- IEP records
- Specific identified documents
Requests are tracked with status (PENDING, IN_REVIEW, APPROVED, DENIED, COMPLETED, APPEALED), a configurable due date, and an assigned staff member. The platform sends notifications to the assigned staff when a request is submitted and tracks overdue requests. Delivery can occur via email, secure portal, in-person pickup, mail, or fax, as configured per request.
3.2 Right to Request Amendment of Records
Parents may request that the school correct records they believe are inaccurate, misleading, or violate the student's privacy rights.
TrackEDU Implementation:
All data records in TrackEDU are editable by authorized district staff. Update operations are fully logged in the audit trail with the actor's identity, timestamp, prior values, and new values so that an amendment history can be produced on request.
3.3 Right to Control Disclosure
Schools generally may not disclose education records without written consent of the parent (or eligible student), except as permitted by FERPA.
TrackEDU Implementation:
TrackEDU does not share student education records with any third party except as authorized by the contracting district. All data is strictly isolated per district (see Section 5). Staff within a district can only access records within that district. Role-based access control (RBAC) further limits which users can see sensitive record categories (see Section 6).
3.4 Right to File a Complaint
Parents may file complaints with the U.S. Department of Education's Student Privacy Policy Office (SPPO) if they believe their rights have been violated.
TrackEDU maintains audit logs that allow districts to demonstrate compliance in the event of an investigation. Districts are encouraged to designate a FERPA compliance officer and post their FERPA annual notice.
4. Permissible Disclosures Under FERPA
TrackEDU is configured to support only the following FERPA-permissible disclosure categories, as directed by the contracting district:
| Permissible Disclosure | Implementation |
|---|---|
| School officials with legitimate educational interest (34 CFR § 99.31(a)(1)) | RBAC restricts access to authorized roles only; staff see only the students they are assigned to or have scope access for |
| Directory information (34 CFR § 99.31(a)(11)) | Districts control what is classified as directory information; TrackEDU does not expose directory fields publicly |
| Health or safety emergency (34 CFR § 99.31(a)(10)) | Emergency access is a separately controlled, audited permission (EMERGENCY_ACCESS) |
| Judicial order or lawfully issued subpoena (34 CFR § 99.31(a)(9)) | Records can be exported under district direction with full audit trail |
TrackEDU does not:
- Sell student education records or any element thereof
- Use student data for advertising or marketing
- Share data across district tenants
- Disclose data to any third party without the district's instruction
5. Data Isolation and Multi-Tenancy
Every school district that uses TrackEDU is a separate tenant. Student education records are logically and technically segregated so that a user in District A can never access records belonging to District B, regardless of how that user is authenticated.
Isolation is enforced at four independent layers:
| Layer | Mechanism |
|---|---|
| 1 – Authentication | Supabase JWT authentication; every authenticated request is tied to a verified user identity |
| 2 – Tenant middleware | tenantIsolation middleware resolves each user's single districtId and wraps every request in a scoped execution context (AsyncLocalStorage); returns HTTP 403 if the user has no district or spans more than one district |
| 3 – Query-layer auto-filtering | A Prisma ORM extension (districtScopeExtension) automatically injects WHERE districtId = ? filters on all read, bulk-update, and bulk-delete operations across 28+ district-scoped data models |
| 4 – Database row-level security (RLS) | PostgreSQL RLS policies (<table>_tenant_isolation) enforce per-district filtering at the database engine level as a backstop for any direct database or Supabase client traffic that bypasses the API |
Every authenticated staff user belongs to exactly one district. The system validates this invariant at login and returns HTTP 403 if it is violated.
6. Role-Based Access Control (RBAC)
TrackEDU implements a granular RBAC system with 21 distinct role types and over 90 discrete permissions. Access to sensitive education record categories is explicitly gated:
| Record Category | Controlling Permissions |
|---|---|
| IEP records | VIEW_IEP, MANAGE_IEP |
| BIP records | VIEW_BIP, MANAGE_BIP |
| BSP records | VIEW_BSP, MANAGE_BSP |
| Health/medical information | VIEW_HEALTH_INFO, MANAGE_HEALTH_INFO, VIEW_STUDENT_MEDICAL |
| Sensitive demographic data | VIEW_STUDENT_DEMOGRAPHICS, VIEW_STUDENT_HOME_LIFE |
| Disciplinary records | READ_SENSITIVE_DATA, READ_INCIDENTS |
| Student plans (IEP documents) | MANAGE_STUDENT_PLANS, ANALYZE_STUDENT_PLANS |
| Data export | EXPORT_STUDENT_DATA, EXPORT_DATA, EXPORT_REPORTS |
| Audit logs | VIEW_AUDIT_LOGS, VIEW_SECURITY_LOGS |
Role permissions are configurable per district. Districts may restrict or expand the default permission set for each role through the district roles management interface. All permission changes are logged in the audit trail.
Additionally, staff access scope may be limited to:
- District-wide: Access all students in the district
- School-wide: Access all students in the staff member's assigned school(s)
- Assigned classrooms: Access only students in classrooms the staff member teaches
- Assigned students: Access only the specific students directly assigned to the staff member
This ensures staff see the minimum set of student records necessary for their role (principle of least privilege).
7. Audit Logging and Activity Tracking
TrackEDU maintains comprehensive audit logs for all significant operations on education records. Every audit log entry captures:
- Who: User ID, role at the time of the action
- What: Action type (CREATE, READ, UPDATE, DELETE, EXPORT_DATA, IMPORT_DATA, LOGIN, LOGOUT, LOGIN_FAILED, ACCESS_DENIED, ROLE_CHANGE, PERMISSION_GRANT, DATA_BREACH_DETECTED, etc.)
- Which record: Resource type and resource ID
- When: Timestamp
- Where from: IP address, user agent, device type
- Change detail: Prior values and new values for update operations
- Context: District and school at the time of the action
7.1 Retention Periods
Audit log retention is enforced at write time. Each log entry is assigned a retention category which determines its expiresAt date. A scheduled cleanup job deletes rows only after that date has passed; no record is ever deleted early.
| Retention Category | Default Period | Covered Events | Configurable Via |
|---|---|---|---|
STUDENT_RECORD | 7 years | Any CRUD on student, incident, IEP, BIP, BSP, intervention, attendance, fidelity check, or tier-assignment records; any log flagged sensitive | AUDIT_RETENTION_STUDENT_RECORD |
DATA_EXPORT | 7 years | EXPORT_DATA, IMPORT_DATA, REPORT_GENERATED — records of what data left the system | AUDIT_RETENTION_DATA_EXPORT |
SECURITY_EVENT | 7 years | DATA_BREACH_DETECTED; ACCESS_DENIED on student resources | AUDIT_RETENTION_SECURITY_EVENT |
ADMIN_CHANGE | 5 years | ROLE_CHANGE, PERMISSION_GRANT, PERMISSION_REVOKE, SYSTEM_CONFIG_CHANGE, BACKUP_CREATED, PASSWORD_CHANGE; CRUD on user/profile records | AUDIT_RETENTION_ADMIN_CHANGE |
AUTH_EVENT | 2 years | LOGIN, LOGOUT, LOGIN_FAILED | AUDIT_RETENTION_AUTH_EVENT |
GENERAL | 1 year | All other operational events | AUDIT_RETENTION_GENERAL |
Retention defaults meet or exceed FERPA minimums. Set the corresponding environment variable (value in days) to extend a period — shortening below the defaults is not recommended without legal review.
The current configuration for any environment is readable by superusers via GET /api/auth/audit/retention-config.
7.2 Log Protection
Log fields containing personally identifiable information (PII) are automatically redacted from application log output (but retained in the database audit tables). Redacted fields include: student ID numbers, dates of birth, medical information, disciplinary records, behavioral records, IEP information, contact information, and all authentication tokens.
8. Data Security
8.1 Encryption at Rest
Student data is stored in a PostgreSQL database hosted on Supabase, which provides AES-256 encryption at rest with automatic key rotation. Supabase infrastructure is SOC 2 Type II certified.
8.2 Encryption in Transit
All API communication occurs exclusively over HTTPS/TLS. The application enforces HTTPS for all authenticated endpoints. HTTP connections are rejected or redirected.
8.3 Authentication and Session Security
- All user authentication is managed through Supabase Auth, which issues short-lived JWT tokens
- Passwords are never stored in TrackEDU's database; Supabase manages password hashing (bcrypt)
- Failed login attempts are tracked per account
- Accounts can be locked after repeated failures (
lockedUntilfield) - Users may be required to change their password upon first login (
requirePasswordChangeflag) - Last password change date is tracked
- Biometric authentication is supported on mobile with cryptographic key storage
8.4 Input Validation and Injection Prevention
- All database access uses Prisma ORM with parameterized queries; raw SQL is not used in API routes
- Request parameters are validated before use; client-supplied
districtIdvalues in request bodies cannot override server-enforced tenant context - Standard Node.js/Express security headers are applied (including
helmet)
8.5 Incident Response
TrackEDU's audit trail includes a DATA_BREACH_DETECTED action type, enabling districts to document and timestamp any detected breach event. Ravlo, LLC maintains internal incident response procedures and will notify affected districts in accordance with applicable law in the event of a confirmed breach.
9. Subcontractors and Sub-Processors
As of the effective date of this document, TrackEDU relies on the following sub-processors that may have access to student education records:
| Sub-Processor | Purpose | Compliance Notes |
|---|---|---|
| Supabase | Database hosting, authentication | SOC 2 Type II; AES-256 encryption at rest; data stored in AWS data centers |
| Resend | Transactional email delivery (notifications) | Processes email addresses and notification content only; no full education records |
| Firebase (Google) | Mobile push notifications (FCM) | Processes device tokens and notification payloads; no full education records |
| Expo | Mobile app delivery and push notification routing | Processes Expo push tokens; no full education records |
Ravlo, LLC enters into data processing agreements with each sub-processor requiring them to maintain confidentiality and security standards consistent with this compliance posture.
10. Data Ownership and Portability
The contracting school district retains full ownership of all student education records entered into TrackEDU. Ravlo, LLC claims no ownership interest in student data.
Upon written request or upon termination of the service agreement, Ravlo, LLC will:
- Provide the district with a complete export of its data in a machine-readable format
- Permanently delete all district data from TrackEDU's systems and sub-processors within 30 days
- Provide written certification of deletion upon request
11. Contractual Commitments
Districts should ensure that their Data Processing Agreement (DPA) or School Service Agreement with Ravlo, LLC includes the following representations:
- Ravlo, LLC agrees to use student education records solely for the purpose of providing the TrackEDU service to the contracting district
- Ravlo, LLC will not sell, rent, or share student data with any third party for commercial purposes
- Ravlo, LLC will implement and maintain appropriate administrative, technical, and physical safeguards
- Ravlo, LLC will notify the district of any confirmed data breach without unreasonable delay
- Ravlo, LLC will comply with the district's lawful instructions regarding the handling of education records
- Ravlo, LLC will permit the district (or its designee) to audit compliance with these terms upon reasonable notice
12. Annual Notice and Opt-Out
FERPA requires districts to notify parents annually of their rights. This obligation rests with the district, not with TrackEDU as a service operator. Districts should:
- Include FERPA rights in their annual notification to parents
- Define and publish their directory information policy (if applicable)
- Maintain a record of any opt-outs from directory information disclosure
TrackEDU does not expose any student data publicly. All access requires authenticated, authorized login.
13. Contact
For questions about this compliance statement or to request a Data Processing Agreement, contact:
Ravlo, LLC
TrackEDU Privacy & Compliance
Email: [email protected]
For district-level FERPA inquiries, contact your district's designated FERPA compliance officer or records custodian.
This document is intended for informational and contractual use by contracting school districts and their legal counsel. It reflects the technical design and operational policies of TrackEDU as of the effective date above. Ravlo, LLC reserves the right to update this document as the product evolves; material changes will be communicated to contracting districts.