Security and FERPA
Student data, handled the way you would.
Your students trusted you with their names, their schedules and their stories. Here is exactly how Socio Connect protects that information, how we support your FERPA obligations, and what we’re still working on.
FERPA
Built to support your FERPA obligations.
FERPA applies to your college. Our job is to make keeping it simple, in writing.
A school official, under your direction
When your contract designates us, we act as a school official with a legitimate educational interest, under your direct control, as FERPA allows. You decide what we hold and who sees it.
Used only to run the service
Student records are used only to provide Socio Connect to your college. We don’t sell personal information, use it for advertising, or build profiles for anyone else.
An agreement you can sign
We sign a student data privacy agreement that sets out purpose, confidentiality, the providers we use, breach notification, and return or deletion of your data when the contract ends.
Your security review, answered
We complete your HECVAT and your security questionnaire, and walk your IT team through how the platform works.
How data is protected
What protects your students today.
Encrypted in transit and at rest
All traffic uses HTTPS. Data at rest is encrypted by our database provider, Supabase. Sign-in tokens for services you connect, such as Google Calendar or Zoom, are encrypted again by our application with AES-256-GCM. API keys and app access tokens are stored only as hashes.
Each college kept separate
Database row-level security applies to every table, so one organization can never read another’s data. Automated isolation tests run on every change and try to reach one organization’s data from another’s accounts. A table without the right rules fails the build.
No passwords to steal
People sign in with a one-time code or link sent to their email, or with Google. Sign-in attempts are rate-limited. Single sign-on through SAML is available on request for campus contracts.
Access by role
Owners, admins, group leaders, members and guests each see only what their role allows, and roles are checked on the server. Changes our own staff make to a customer’s account are written to an audit log that can’t be edited or deleted.
Careful logging
Error reports have secrets, cookies and sign-in headers removed before they leave the app, and session replays mask all text. Product analytics never include names or email addresses.
Two-step sign-in
Anyone can add an authenticator app, such as Google Authenticator, Microsoft Authenticator, 1Password or Authy. After that, every sign-in also needs a 6-digit code, and the database itself refuses access until it’s entered. Our own staff always use it, and your college can require it for all of its admins.
Every staff view recorded
Each time our staff open your college’s member list or recent posts, or search your members, it’s recorded with who, what and when. Nobody can edit or delete these records, including us, and your admins can see them under Admin > Security.
No card data
Payments are handled by Stripe. Card and bank details never touch Socio Connect, and gifts go straight to your college’s own Stripe account.
AI that drafts, people who decide
The Assistant’s drafts and summaries use Anthropic’s Claude models, which don’t train on content sent through the API. We send only what a feature needs. Every draft is reviewed and sent by your staff. Conversations with Ask are deleted after 180 days.
Texts only with consent
Texts go only to people who agreed to receive them. Replying STOP opts a number out, and every change of consent is timestamped.
The providers we use
Every company that touches your data.
Each is bound by its own terms with us, and each is listed in your agreement. We tell you before we add a new one.
| Provider | What for |
|---|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Application hosting (United States) |
| Stripe | Payments and gifts, paid to your own account |
| Resend | Email delivery |
| Twilio | Text messages |
| Anthropic | AI drafts, summaries and answers |
| Search and some AI features | |
| Apple and Google | Notifications to phones |
| Mixpanel | Product analytics, without names or email addresses |
| Sentry | Error reports, with sensitive data removed |
What we’re working on
Honest about what’s next.
Your IT team will ask about these, so here they are first. None of them is in place yet. We’ll update this page the day each one ships.
- A full self-serve export of everything your college has added (today we provide a full export whenever you ask)
- SOC 2, starting with a readiness assessment
- An accessibility conformance report (VPAT) against WCAG 2.1 AA, with automated accessibility checks on every change
- A written schedule for data retention, and an independent penetration test
Questions IT teams ask.
Something else? hello@socio-connect.com