Compliance Documents
These documents are available upon request for any school district evaluating or currently using Evident.
Student Privacy Commitments
Twelve public promises about student personal information: no selling, no advertising, no profiling, data minimization, retention limits, access and correction, a security program, and vendor and successor obligations, each tied to the control that makes it true. Published in the spirit of the retired industry Student Privacy Pledge, in our own words, so they can be held against us.
Data Privacy and Security Plan (NY Education Law §2-d)
The plan 8 NYCRR §121.6 requires of every contractor, published in full. Purposes, safeguards arranged by the NIST Cybersecurity Framework functions, training, subcontractors, breach handling with 24-hour notice, and return or deletion at the end of an agreement, together with the supplemental information a school attaches to its Parents' Bill of Rights. Downloadable as one document with a signature block; a signed copy on letterhead is sent on request.
School Procurement Packet
Self-Serve School Review. A single packet covering security overview, privacy summary, DPA/NDPA information, subprocessors, retention/deletion, accessibility readiness, implementation FAQ, rostering options, and support contacts.
- Designed for privacy, IT, and school leadership review
- Links to DPA, security, accessibility, and school plan surfaces
- Plain answers for school privacy and purchasing reviews
Annual Security & Privacy Assessment
SOC 2 Trust Services Criteria structure. An annual assessment of Evident's security controls, infrastructure, identity management, vulnerability management, and EdTech-specific privacy workflows (FERPA/COPPA). Includes our full subprocessor inventory, data classification matrix, and encryption standards. This assessment is structured to align with the SOC 2 Trust Services Criteria; it is Evident's own assessment and is not a third-party SOC 2 certification of Evident.
- SOC 2 TSC-aligned structure
- Full infrastructure & subprocessor inventory
- Vulnerability scanning & testing results
- FERPA/COPPA-related audit logging evidence
- Data retention & disposal documentation
Management's Assertion Letter
CEO-signed security & privacy attestation. Formal attestation from Evident's CEO summarizing security and privacy controls. Covers authorized use, security safeguards, regulatory documentation, data sovereignty, data minimization, and disposal protocols.
- CEO-signed on company letterhead
- Summarizes DPA/NDPA-aligned controls
- Attached as cover to the Security Assessment
- NIST-informed cybersecurity framework mapping
Incident Response Plan Summary
NIST-informed incident response process. Summary of Evident's written data breach response plan, provided for school privacy review. Covers our incident classification matrix, NIST-informed response process, 24-hour notification target, and post-incident review procedures.
- NIST-informed response structure
- 4-phase response process documented
- 24-hour school notification commitment
- Post-incident review & remediation process
- Annual tabletop exercise commitment
Data Processing Agreement (DPA)
DPA/NDPA documentation for school districts. Evident provides DPA/NDPA documentation for school privacy review, based on common student data privacy agreement structures. Review DPA information or contact us to discuss district-specific terms.
- DPA/NDPA documentation available for review
- Data elements documented
- Subprocessor list with all 10 vendors
- Data disposition workflow documented
- District-specific terms can be discussed
Compliance Frameworks
Evident's school privacy review is structured around the frameworks district legal, privacy, and IT teams expect to see during procurement:
- DPA/NDPA: Student privacy documentation
- FERPA: Family Educational Rights & Privacy Act
- COPPA: Children's Online Privacy Protection Act
- GDPR: EU General Data Protection Regulation: processor terms, EU data residency, and a DPA for signature
- NY Education Law §2-d: Data Privacy and Security Plan and Parents' Bill of Rights supplement, published and downloadable
- NIST-informed: Cybersecurity review structure
Documentation your district's legal, privacy, and IT teams can use to evaluate Evident for a pilot or school license.
Security at a Glance
Key security metrics and controls that protect your student data.
- 50 suites (Database Integration Tests): Checks for access across staff roles and schools
- AES-256 (Encryption at Rest): All student data
- TLS 1.2+ (Encryption in Transit): Every connection, TLS 1.3 preferred
- 24hr (Breach Notification Commitment): From becoming aware, to the school
- 60 day (Data Disposition): On DPA termination
- RLS (Tenant Isolation): Database-level enforcement
How to Request Compliance Documents
- 1. Contact Us: Email us at your convenience or use the contact form. Include your district name, your role, and which documents you need.
- 2. Verification: We verify your identity as an authorized representative of the school district. For existing DPA partners, we respond within 2 business days.
- 3. Document Delivery: Documents are delivered via secure email. DPA/NDPA information and request paths are available on the DPA page. Assessment reports and the IRP Summary are provided within 5 business days.
GDPR (EU Schools)
For schools in the European Union and the United Kingdom, Evident acts as a data processor for the student records a school enters, and the school remains the data controller. Evident is the controller only for its own staff-account, billing, website and marketing data. EU schools are served from a dedicated EU deployment at eu.evidentk12.com: the database, authentication, file storage and application compute run in Frankfurt, Germany; transactional email is sent from Ireland; product analytics run on PostHog EU; and family-facing translation is processed in France by Mistral AI with student names removed first. AI drafting of student records is switched off on the EU deployment.
- Data Processing Agreement: an Article 28 DPA with EU Standard Contractual Clauses for the limited US-located services is available for signature. Request it from the DPA page.
- Sub-processors: the full list, with each provider's location for the EU deployment, is published on the DPA page; schools receive 30 days' written notice before any new sub-processor touches their data and may object.
- Special-category data: support needs, behaviour records and counsellor notes about students are treated as Article 9 data. Evident segregates counsellor-only notes at the database layer, keeps names and free text out of audit logs and analytics, and provides schools a field-by-field inventory for their own Article 9 and DPIA work on request.
- Data subject rights: staff can export their account data as a portable JSON bundle from Settings; schools can request organisation-level export, correction and deletion, and Evident assists within the GDPR one-month window.
- Retention: defined retention periods are enforced by a weekly scheduled purge, and student records are returned and deleted at the end of a contract on the timeline the DPA sets.
Our Breach Notification Commitment
If Evident becomes aware of a personal data breach involving Student Data, we notify the affected school or district within 24 hours of becoming aware, with the information the school needs for its own regulatory and family notifications. We do not wait for the investigation to finish; an initial notice goes out and is updated as facts are confirmed.
Our notification includes:
- Provider identification and direct contact information
- Incident timeline with date of breach and date of discovery
- Plain-language description of what happened
- Specific Student Data elements affected (referencing Exhibit B)
- Identification of impacted individuals
- Corrective actions taken and ongoing remediation steps
Ready to Partner with Evident?
Start with the procurement packet, review DPA/NDPA documentation and security materials, then contact us for school-specific review needs.