Asperix builds for California K–12 districts, so student privacy is part of the design, not an add-on. Here is exactly how we handle student data, in plain language, before your IT team has to ask.
These hold for every district, and they're backed by the data privacy agreement we sign with you.
Student records belong to the district. Your SIS stays the source of truth, and we never write back to it.
We don't sell student data, share it with data brokers or use it for advertising of any kind.
No student record is sent to, processed by, or used to train any AI or large language model.
Each district runs on its own dedicated database. Your data is never mixed with another district's.
We collect the minimum fields required to run and document placements, and nothing more.
When a contract ends, we return or delete district data on the timeline set in your signed agreement.
Student data in Asperix ISST is never sent to, processed by, or used to train any AI or large language model. No AI features touch student records. If that ever changes, it will happen only with the district's written agreement and an updated data privacy agreement.
Asperix ISST is built to meet federal and California student-privacy law, and we sign the California Student Data Privacy Agreement.
We act under the district's direct control as a school official with a legitimate educational interest.
Student accounts exist only at the district's direction, for the school's educational purpose.
No targeted advertising, no student profiles for non-school purposes, no sale of student data.
District ownership and control, deletion at contract end, and breach notification, all in the contract.
These are the only third parties that process district data on our behalf. Each is bound by its own security and data-protection terms.
| Provider | Purpose | Data involved |
|---|---|---|
| Supabase | Database, authentication and file storage | Placement records, user accounts, work-sample files |
| Replit | Application hosting | Processes requests to the application |
| Resend | Email delivery (reminders and notifications) | Recipient names and email addresses, message content |
We give contracted districts at least 30 days' notice before adding a new subprocessor that will process district data.
Request our DPA and IT approval packet, or report a security concern directly.