This document summarizes how EX in Education protects district data. It is meant to answer the
questions a district's IT or security team typically asks. We aim to describe only what is true
today and to be explicit about what is in progress. Questions or a security questionnaire:
eric@exineducation.com.
1. What the platform is (and what data it needs)
EX in Education is an educator-experience platform (evaluations/observations, professional
development, coaching, surveys, recognition, onboarding, and related staff workflows). It is a
system of engagement for staff data and does not require student
personally identifiable information to function. The data we process is primarily staff
identifiers and educator work product, plus standard usage/audit logs.
2. Hosting & infrastructure
- Hosted on Amazon Web Services (AWS) in the United States.
- Application servers run in a private network; the managed PostgreSQL database is not publicly accessible.
- Application secrets (database credentials, keys) are stored in AWS Secrets Manager, not in source code, and loaded at runtime.
3. Encryption
- In transit: TLS/HTTPS for all traffic to the application.
- At rest: the database and stored files are encrypted at rest (AES-256).
4. Access control & least privilege
- Role-based access control (RBAC): users see only what their role permits (e.g., teacher, evaluator, principal, district admin).
- Internal separation of duties: our internal staff roles are least-privileged. Destructive and privileged operations (database management, tenant deletion, role assignment, user impersonation) are restricted to a single platform-administrator role; broader internal/sales access cannot perform them.
- Access to production by our team is limited and authenticated.
5. Multi-tenant data isolation
Every district is a separate tenant, and isolation is enforced in two independent layers:
- Database row-level security (RLS): core data tables (including users,
evaluations, observations, and schools) carry forced RLS policies that restrict every
row to the active tenant. The application connects through a least-privilege database
role that is neither a superuser nor the table owner, so these forced policies apply to the
application's own queries, and a query cannot return another tenant's rows even if application
code had a bug.
- Application-level scoping: every request is additionally scoped to the
requesting user's tenant in the query layer.
Cross-tenant access paths are reviewed as part of our change process.
6. Authentication
- Authentication uses signed tokens delivered via httpOnly cookies; a user's role and active status are re-checked from the database on each request, so access changes (e.g., deactivating a departed employee) take effect immediately.
- Passwords are hashed with bcrypt; policy aligned to NIST 800-63B guidance (length-based, screened).
- Administrative and security-relevant actions are recorded in an audit log.
- Single sign-on (SSO): available on the roadmap for district rollouts; contact us for current status.
7. Backups & recovery restore verified
- Automated daily backups with point-in-time recovery, retained for the backup window; backups are encrypted.
- We periodically perform and verify a real restore (restore a backup to an isolated instance and confirm data integrity), so recovery is proven, not assumed.
- Recovery objectives: RPO ~5 minutes (point-in-time recovery) and RTO ~20-40 minutes for a database restore. We will state the contractual figures in a district's agreement.
8. Data privacy & FERPA
- To the extent we process education records, we act as a "school official" with a "legitimate educational interest" under FERPA, under the district's direction.
- We do not sell data and do not use it for advertising.
- Districts own their data and can export or delete it.
- A Data Privacy Agreement (DPA) is available on request, and we are glad to sign a district's own DPA/NDPA (including SDPC/state-standard forms). See also our Privacy Policy.
9. Subprocessors
| Subprocessor | Purpose | Location |
|---|
| Amazon Web Services (AWS) | Cloud hosting, database, storage, secrets | United States |
| Amazon SES | Transactional email | United States |
| Stripe | Billing/payments (no education records) | United States |
| Amazon Bedrock (AWS) | AI insights (portfolio summaries, suggested observation feedback) on de-identified rubric signals only — rubric labels, scores, bands, and trends; never names, written notes, or any student information. Zero data retention; on by default, and a district can disable it in settings. Also serves the optional AI document Q&A on a district’s own uploaded documents (enabled per tenant; off by default) | United States |
| Anthropic | Fallback provider for the optional AI document Q&A (used only if Amazon Bedrock is unavailable; same no-training commercial API terms; feature off by default) | United States |
| Google | Optional “Sign in with Google” — authentication identifiers only (name, email) | United States |
| Microsoft | Optional single sign-on (Microsoft Entra) — authentication identifiers only | United States |
A current subprocessor list is available to districts, with a means to be notified of material changes.
10. Incident response & breach notification
We maintain application error and security monitoring. Following confirmation of a security
incident affecting a district's data, we will notify the district without unreasonable delay,
cooperate in investigation and remediation, and provide the information the district needs to meet
its own obligations. Specific timelines are committed in the DPA.
11. Data retention & deletion
Districts own their data; we retain it for the term of the agreement. We provide export
and deletion on request, and we return and/or securely destroy district
data on termination, except where retention is required by law.
12. Secure development & change management
- Changes go through an automated security review before deployment, with high/medium findings resolved before release.
- Deployments run pre-flight checks and a post-deploy health gate; a failed health check fails the deploy.
- Soft-delete and tenant-isolation patterns are enforced by pre-commit checks.
13. AI features & data use
- AI insights (portfolio summaries and suggested observation feedback) run on Amazon Bedrock (Claude), in the United States, over an encrypted API. They receive only de-identified rubric signals: framework criterion labels, numeric scores, performance bands, and trends. Names, evaluators’ written notes, and student information are never sent — excluded structurally by a typed payload contract, not just by policy. These insights are on by default, and a district administrator can turn all AI insights off in District Settings at any time. A monthly spend cap applies per district.
- The optional grounded question-answering over a district’s own handbooks/policies also runs on Amazon Bedrock (Claude), in the United States (with the direct Anthropic commercial API as a fallback provider), and is off by default (a district administrator enables it per tenant).
- Your data is not used to train models. Bedrock does not retain prompts or completions, and we do not enable model-invocation logging (zero data retention). Under Anthropic's commercial API terms, inputs and outputs are not used to train their models. We do not sell data or use it for advertising.
- Text embeddings used for search are generated within our own infrastructure (not sent to a third-party AI provider).
- AI output is assistive and labeled as AI-generated: a person reviews and decides; the system does not take consequential actions on its own. It is never the authoritative evaluation record.
14. What we are transparent about
We are an early-stage company and want districts to have an accurate picture:
- Our practices are aligned to recognized security standards, but we have not yet completed a third-party audit (such as SOC 2 or ISO 27001) or an independent penetration test. We are happy to complete a district's security questionnaire and to discuss our roadmap.
- Hardening on our roadmap includes high-availability database failover (Multi-AZ) and cross-region backup copies, which we enable as we onboard districts.
Security questions, questionnaires, or to request a DPA: eric@exineducation.com.