Privacy & Security
Designed to work without student names
IEP Studio provides no fields for student names, birthdates, ID numbers, addresses, or photos. Use initials or a private classroom code, and do not enter identifying details in free-text fields. Data minimization lowers risk, but initials and context do not automatically make a record de-identified; educators should still follow school and district policy.
Encryption
All traffic between your browser and IEP Studio is encrypted with TLS. Data is stored on Supabase (built on PostgreSQL, hosted on AWS in the United States) and encrypted at rest. Access to production data is restricted and audited.
Row-level isolation
Your records are protected by database row-level security: every query is scoped to your authenticated account at the database layer, not just the application layer. No other user can read your caseload data.
No selling. No ads. No AI training
We do not sell customer data or run third-party advertising. IEP Studio does not use your goals or progress data to train AI models. Anthropic states that commercial API inputs and outputs are not used for model training by default.
How AI requests are processed
When you use Goal Studio or generate a family summary, the information needed for that request is sent to Anthropic's commercial API. Anthropic states that standard API inputs and outputs are deleted from its backend within 30 days, except where a different agreement applies or longer retention is needed for policy enforcement or legal obligations. Do not include student names or other direct identifiers in prompts.
You own your data
Export your goals and progress data at any time. You can also request account deletion when you no longer need the service. Infrastructure backups may follow separate recovery and deletion schedules described in the privacy policy or an applicable district agreement.
FERPA, honestly stated
IEP Studio does not claim a government 'FERPA certification.' FERPA responsibilities depend on how a school or district uses a service and whether information can identify a student directly or in combination with other details. We minimize the student data the product requires, provide account-level access controls, and can review a data privacy agreement with schools or districts at hello@iepstudio.app.