SOPPA Compliance Statement — TrackEDU
Student Online Personal Protection Act (105 ILCS 85/)
Document version: 1.0
Effective date: May 9, 2026
Prepared by: Ravlo, LLC (operator of TrackEDU)
1. Overview
This document describes how TrackEDU, a product of Ravlo, LLC, is designed and operated to comply with the Illinois Student Online Personal Protection Act (SOPPA), 105 ILCS 85/, as amended by Public Acts 101-0516 and 102-0921. SOPPA establishes requirements for operators of websites, online services, online applications, and mobile applications that are used primarily for K–12 school purposes and collect, maintain, use, or share covered information about students.
TrackEDU is a covered operator under SOPPA because it is a web and mobile application used by Illinois K–12 school districts for educational purposes and it collects and processes covered information (defined below) about students.
Ravlo, LLC enters into contracts with contracting school districts that function as endorsing school officials under SOPPA. This document describes Ravlo, LLC's obligations as an operator and how TrackEDU's technical design satisfies them.
2. Covered Information Collected
Under SOPPA, "covered information" means personally identifiable information or material, or information that is linked to personally identifiable information, in any media or format, that is not publicly available and is about a student. TrackEDU collects and processes the following covered information on behalf of contracting districts:
| Category | Data Elements |
|---|---|
| Student identifiers | First name, last name, student ID number |
| Demographic information | Date of birth, gender, race/ethnicity, primary and secondary languages |
| Enrollment information | Grade level, classroom assignment, school assignment, district, enrollment date, academic level |
| Behavioral and disciplinary records | Behavior incidents (type, severity, location, description, date/time, resolution), MTSS/PBIS tier assignments, intervention records, fidelity checks |
| Special education records | IEP status, category, dates, and notes; BIP status, category, dates, and notes; BSP status, category, dates, and notes; student plans/documents |
| Health and medical information | Allergies, dietary restrictions, medications, medical conditions, medical notes |
| Socioeconomic and household information | Foster care status and notes, homeless/McKinney-Vento status and notes, living situation and notes, grade retention history |
| Attendance records | Attendance dates, statuses, notes |
| Guardian/parent information | Guardian name, email, phone, relationship to student, pickup authorization |
3. SOPPA Operator Obligations and TrackEDU's Implementation
3.1 Prohibited Uses of Student Data
SOPPA prohibits operators from using covered information for the following purposes. TrackEDU is contractually and technically designed to prevent all of these:
| SOPPA Prohibition | TrackEDU Position |
|---|---|
| Selling student data | Prohibited. Ravlo, LLC does not sell, rent, barter, or otherwise trade student data for monetary or other consideration. |
| Using student data for behavioral advertising | Prohibited. TrackEDU does not serve any advertisements, behavioral or otherwise, to any users. Student data is never used for advertising targeting. |
| Using student data to build a profile for non-educational purposes | Prohibited. Student data is processed exclusively for the purposes of providing TrackEDU's K–12 behavior and intervention support services. No profile is built or sold for commercial purposes. |
| Disclosing student data to third parties for commercial gain | Prohibited. Student data is not disclosed to any third party for commercial purposes. Sub-processors listed in Section 7 receive data only to the extent necessary to deliver the service. |
| Retaining student data beyond the scope of the contract | Addressed. TrackEDU deletes all district data within 30 days of contract termination (see Section 8). |
3.2 Permitted Uses of Student Data
TrackEDU uses covered information only for the following SOPPA-permitted purposes:
- Providing and improving the TrackEDU service as requested and directed by the contracting district
- Developing and improving the features and functionality of TrackEDU for K–12 educational use
- Responding to a student's or parent's request for information or for their own records
- Complying with legal requirements, including responding to lawful court orders or subpoenas
- Protecting the safety of users and others in accordance with applicable law
- Maintaining the security and integrity of the service
3.3 Data Retention and Deletion
SOPPA requires operators to delete covered information when the district requests deletion and upon termination of the contract.
TrackEDU Implementation:
- Upon district request: Authorized district administrators may delete individual student records within the TrackEDU interface. All deletion actions are recorded in the audit log with the acting user's identity and timestamp.
- Upon contract termination: Ravlo, LLC will permanently delete all covered information belonging to the district within 30 days of the contract end date. This includes deletion from primary databases, backups, and sub-processor systems. Ravlo, LLC will provide written certification of deletion upon request.
- Automated cleanup: Student records that are deleted by district staff are removed from active data. Audit log entries referencing deleted records are retained for their applicable retention period (up to 7 years for sensitive records, per FERPA requirements) but contain only the audit metadata, not the full record content.
3.4 Security of Covered Information
SOPPA requires operators to implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information.
TrackEDU implements the following security controls:
Technical Controls
| Control | Implementation |
|---|---|
| Encryption at rest | AES-256 encryption provided by Supabase (SOC 2 Type II certified) for all database content |
| Encryption in transit | HTTPS/TLS enforced on all endpoints; plaintext HTTP is rejected |
| Authentication | Supabase Auth with short-lived JWT tokens; passwords are never stored in TrackEDU's database |
| Multi-factor authentication | Available via Supabase Auth configuration (district-configurable) |
| Failed login lockout | Failed login attempts are tracked per account; accounts can be locked after repeated failures |
| Biometric authentication | Supported on the TrackEDU mobile app with cryptographic key storage |
| Session management | JWT tokens are short-lived; refresh tokens are required for session continuation |
| Parameterized queries | All database queries use Prisma ORM with parameterized queries; SQL injection is structurally prevented |
Access Control
| Control | Implementation |
|---|---|
| Role-based access control (RBAC) | 21 distinct staff roles with 90+ granular permissions; access to sensitive records (IEP, BIP, health, demographics, home life) is separately gated |
| Tenant isolation | Strict per-district data isolation enforced at 4 independent layers (see Section 4); no user can access data from another district |
| Principle of least privilege | Staff access scope can be restricted to district, school, assigned classrooms, or assigned students only |
| Permission auditing | All permission grants and revocations are logged in the audit trail |
Audit and Monitoring
| Control | Implementation |
|---|---|
| Comprehensive audit logging | Every CREATE, READ, UPDATE, DELETE, EXPORT, LOGIN, and ACCESS_DENIED event is logged with actor identity, timestamp, IP address, and record identifier |
| Sensitive field log redaction | PII fields (student ID, date of birth, medical information, behavioral records, IEP information, contact info) are automatically redacted from application log output |
| Audit log retention | Each log entry is assigned a retention category at write time and deleted only after its expiresAt date passes. Categories: student-record events (7 yr), data exports (7 yr), security events (7 yr), admin changes (5 yr), auth events (2 yr), general operations (1 yr). A scheduled daily cleanup job enforces these periods automatically. |
| Breach detection | Audit trail includes a DATA_BREACH_DETECTED action type for documenting and timestamping detected breach events |
3.5 Transparency and Notice
SOPPA requires operators to have a privacy policy that describes their practices regarding covered information.
Ravlo, LLC maintains a Privacy Policy and this compliance documentation. Districts should post links to these resources in their data use notices to parents.
4. Data Isolation and Tenant Architecture
TrackEDU is a multi-tenant SaaS platform. Every school district is a separate tenant. Student data belonging to one district is completely inaccessible to users of any other district.
Isolation is enforced at four independent, defense-in-depth layers:
Layer 1 — Authentication
All access requires a valid Supabase JWT. Unauthenticated requests are rejected before reaching any data layer.
Layer 2 — Tenant Middleware (tenantIsolation)
Every authenticated API request passes through tenantIsolation middleware, which:
- Looks up the authenticated user's district assignment
- Validates that the user belongs to exactly one district (HTTP 403 if zero or more than one)
- Stores the
districtIdin anAsyncLocalStoragescope context for the duration of the request - Ensures that single-row mutation handlers set
districtIdfrom the server-resolved context, never from the client request body
Layer 3 — Prisma ORM Extension (districtScopeExtension)
A custom Prisma ORM extension automatically appends WHERE districtId = ? to every read, bulk-update, and bulk-delete operation across 28+ district-scoped data models. This means a bug in an individual API handler cannot accidentally expose cross-district data on read operations.
Layer 4 — PostgreSQL Row-Level Security (RLS)
PostgreSQL RLS policies (<table>_tenant_isolation) are applied to all student-scoped tables. These policies act as a backstop for any direct database access or Supabase client traffic that bypasses the API server. RLS is enforced at the database engine level.
5. Parental and Student Rights
SOPPA grants parents and eligible students rights with respect to their covered information. TrackEDU provides the mechanisms for districts to fulfill these rights:
5.1 Right to Access Records
Parents and eligible students may request access to covered information held about the student. TrackEDU includes a formal Data Access Request workflow that districts can use to track, assign, and fulfill access requests. Request types supported include:
- All records
- Academic records
- Disciplinary records
- Health records
- IEP records
- Specific identified documents
Requests are tracked with status, due date, assigned staff, and delivery method (email, secure portal, in-person pickup, mail, fax).
5.2 Right to Correction
If covered information is inaccurate, parents or eligible students may request correction. Authorized district staff may update any record in TrackEDU. All updates are logged in the audit trail with the prior and new values, enabling the district to demonstrate compliance.
5.3 Right to Deletion
Districts may delete student records on request from parents or eligible students. Deletion is logged in the audit trail.
6. Staff Roles with Access to Student Data
SOPPA requires that covered information be disclosed only to individuals with a legitimate educational purpose. TrackEDU enforces this through its RBAC system. Staff roles with default access to student education records include:
| Role | Typical Access Scope |
|---|---|
| District Administrator | All student data within the district |
| Principal | All students within their school |
| Assistant Principal / Dean | All students within their school |
| Counselor | All students within their school |
| Special Ed Coordinator | Special education records (IEP, BIP, BSP) for assigned students |
| Behavior Specialist | Behavioral records for assigned students |
| Teacher / SPED Teacher | Students in assigned classrooms |
| Nurse | Health information for assigned students |
| Social Worker | Assigned students |
| Teachers' Assistant | Students in assigned classrooms |
| Guardian | Only their own child(ren)'s records |
All role permissions are configurable per district. Districts may restrict access below the defaults. No staff member has access to records outside their assigned district.
7. Sub-Processors
Ravlo, LLC uses the following sub-processors that may process covered information as part of delivering TrackEDU:
| Sub-Processor | Data Processed | Purpose | Security Certifications |
|---|---|---|---|
| Supabase | All student database records; authentication credentials | Database hosting (PostgreSQL), user authentication | SOC 2 Type II; ISO 27001 (via AWS); AES-256 at rest |
| Resend | Email address, notification message content | Transactional email delivery (staff notifications) | SOC 2 Type II |
| Firebase (Google) | Device tokens, notification payload | Mobile push notification delivery | ISO 27001; SOC 2; GDPR compliant |
| Expo | Expo push tokens, notification payload | Mobile app platform and push notification routing | Standard cloud security practices |
No sub-processor receives full student education records. Email and push notifications contain only the minimum information necessary to alert staff (e.g., "A new incident has been reported for [student name]"). Full records are accessible only through the authenticated TrackEDU application.
Ravlo, LLC will update this list when sub-processors change and will notify contracting districts of any material changes to sub-processor arrangements.
8. Data Retention and Deletion Schedule
| Scenario | Action | Timeline |
|---|---|---|
| Parent/eligible student requests deletion of specific record | District staff deletes via TrackEDU UI; deletion logged in audit trail | At district's discretion; immediately upon district action |
| District requests complete data deletion | Ravlo, LLC deletes all district data from primary database and sub-processors | Within 30 days of written request |
| Contract termination | Ravlo, LLC deletes all district data from primary database and sub-processors; provides written certification | Within 30 days of contract end date |
| Staff-deleted records | Removed from active data immediately | Immediate |
| Audit log entries | Retained per log category: student-record/data-export/security-event logs 7 years; admin-change logs 5 years; auth-event logs 2 years; general logs 1 year. A scheduled daily cleanup job deletes only rows past their computed expiresAt date. | Per schedule |
9. Incident Response and Breach Notification
In the event of a confirmed breach of covered information, Ravlo, LLC will:
- Contain the breach and preserve evidence
- Notify the contracting district without unreasonable delay and no later than as required by applicable law (including the Illinois Personal Information Protection Act, 815 ILCS 530)
- Cooperate with the district in fulfilling the district's notification obligations to parents and applicable regulatory bodies
- Provide a written incident report describing the nature of the breach, data involved, affected individuals, and remediation steps taken
- Document the event in TrackEDU's audit trail using the
DATA_BREACH_DETECTEDaction type
Ravlo, LLC maintains an internal incident response plan that is reviewed at least annually.
10. Contractual Requirements
Under SOPPA, school districts must enter into a written contract with any operator that collects covered information. The contract must address the following, all of which are incorporated into Ravlo, LLC's standard School Service Agreement and Data Processing Agreement:
| SOPPA Contract Requirement | TrackEDU / Ravlo, LLC Position |
|---|---|
| Specify the purpose for which covered information is disclosed to the operator | Purpose limited to providing TrackEDU services |
| Prohibit the operator from using covered information for any other purpose | Contractually prohibited; technically enforced |
| Require the operator to implement security measures | AES-256 encryption, TLS, RBAC, audit logging, tenant isolation |
| Require deletion of covered information at contract termination | Within 30 days of termination; written certification available |
| Require the operator to disclose to the district any unauthorized data release | Without unreasonable delay per applicable law |
| Require the operator to comply with the district's instructions regarding covered information | Fully compliant; district retains data ownership and control |
11. Illinois-Specific Provisions
11.1 Student Biometric Information
TrackEDU supports biometric authentication (fingerprint/face ID) on the mobile application for staff users only. No student biometric information is collected. Biometric public keys are stored securely and are used solely for staff authentication purposes.
11.2 Geolocation
TrackEDU does not collect precise real-time geolocation data from students or staff. Location fields in incident records (e.g., "hallway," "cafeteria," "classroom") are descriptive text entered by staff, not device GPS coordinates.
11.3 Data Minimization
TrackEDU only collects covered information that is entered by authorized district staff. There is no passive or automated collection of student behavioral data, device identifiers, browsing history, or similar data.
12. Compliance Attestations
As of the effective date of this document, Ravlo, LLC attests that TrackEDU:
- Does not sell student covered information
- Does not use covered information for behavioral advertising
- Does not build student profiles for non-educational commercial purposes
- Does not disclose covered information to third parties for commercial gain
- Does implement AES-256 encryption at rest
- Does implement TLS encryption in transit
- Does maintain comprehensive audit logs of data access
- Does enforce role-based access control limiting data access to authorized staff
- Does enforce strict per-district tenant isolation at multiple technical layers
- Does provide a formal data access request workflow for parental rights
- Does support record deletion by authorized district administrators
- Does delete all district data within 30 days of contract termination
- Does maintain a written incident response plan
13. Contact
For questions about this compliance statement, to request a Data Processing Agreement, or to report a privacy concern, contact:
Ravlo, LLC
TrackEDU Privacy & Compliance
Email: [email protected]
For school- or district-level questions about student privacy rights, contact your district's designated Student Data Privacy contact or FERPA compliance officer.
This document is intended for informational and contractual use by contracting school districts, their legal counsel, and Illinois Student Data Privacy Consortium (ISDPC) reviewers. It reflects the technical design and operational policies of TrackEDU as of the effective date above. Ravlo, LLC will update this document when material changes occur and will notify contracting districts accordingly.
Appendix A: Relevant Illinois Law References
| Statute | Title | Relevance |
|---|---|---|
| 105 ILCS 85/ | Student Online Personal Protection Act (SOPPA) | Primary governing law for this document |
| 105 ILCS 10/ | Illinois School Student Records Act (ISSRA) | State law governing school student records; complementary to SOPPA |
| 815 ILCS 530/ | Personal Information Protection Act | Breach notification requirements |
| 20 U.S.C. § 1232g; 34 CFR Part 99 | FERPA | Federal law; see separate FERPA Compliance Statement |
| 20 U.S.C. § 1400 et seq. | IDEA | Federal law governing IEP/special education records |
Appendix B: Illinois Student Data Privacy Consortium (ISDPC)
TrackEDU supports districts in completing data sharing agreements through the Illinois Student Data Privacy Consortium (ISDPC). Ravlo, LLC is willing to execute the ISDPC standard Data Sharing Agreement (DSA) with any contracting Illinois district.
Prospective district partners may contact Ravlo, LLC at [email protected] to initiate the ISDPC DSA process.