Security and data privacy
District data deserves district grade protection. Here is how Avalern handles it.
Compliance
- FERPA: Avalern acts as a school official under FERPA and processes student and educator data only on the district's instructions.
- Data privacy agreements: We sign district DPAs, including the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement, on request.
- SOC 2: A SOC 2 audit is in progress with evidence managed in Vanta. The report will be available under NDA once issued.
- State requirements: We work with districts to meet the student data privacy laws that apply in their state. Ask us about your state's requirements.
Infrastructure
- Hosting: Application hosted on Vercel; database on Neon (managed PostgreSQL) in US regions.
- Backups: Data is backed up automatically and encrypted at rest.
- Encryption: TLS 1.2+ in transit; AES 256 at rest.
- Access control: Role based access control; district administrators control who sees what. Passwords hashed with bcrypt.
Operations
- Status: Live system status at avalern.com/status.
- Incident response: We notify affected districts promptly after a confirmed breach, with the scope of the incident and the steps taken to resolve it.
- Data retention and deletion: Data is returned or deleted at contract end on the district's instruction.
Contact
Security questions or vulnerability reports: info@avalern.com
