- SOC 2 audited by CertPro
- Built for FERPA and HIPAA
- BAA available
Security and compliance, built for student data.
How we protect student data, and the documents your IT and procurement teams will ask for.
Our commitments
What we commit to
SageReport handles sensitive student information. We treat that responsibility seriously.
This page explains how we protect your data, what compliance measures are in place, and what we're working toward. If you have questions not covered here, contact us.
Your data is never used to train AI
We do not train any AI models on your data. Your cases, reports, and student information are used only to provide the service to you, nothing else.
We don't access your data
Our team does not access your student data in the normal course of operations. When access is necessary for support or maintenance, it is limited to the minimum required and fully logged.
Secure cloud infrastructure
All data is stored on Google Cloud Platform (GCP) in the United States, with enterprise-grade security controls.
Encryption everywhere
Data is encrypted in transit (TLS) and at rest (AES-256). Access controls and comprehensive audit logging cover data access and administrative actions.
You control your data
Export your reports anytime. Delete cases when you choose. If you close your account, data is kept for a short recovery window (30 days for individual accounts, 90 days for district accounts), then permanently deleted, except where the law or your agreement requires us to keep something.
Compliance status
Where we stand
SageReport is built to meet the standards school districts require. Here's our current status.
| Standard | Status |
|---|---|
| FERPA (school official designation, district DPA) | In place |
| BAA with Google Cloud | In place |
| HIPAA-aligned (Business Associate), BAA available | In place |
| SOC 2 Type IAudited by CertPro, with a clean report. | Complete |
Our SOC 2 report is available on request.
FERPA compliance
For districts, SageReport operates as a school official under FERPA: under your direct control, using education records only for the contracted purpose, with no redisclosure. Those terms are set in the data privacy agreement we sign with each district.
We maintain the administrative, technical, and physical safeguards required for handling student education records.
If your district requires specific documentation or agreements,contact us and we'll work with your team.
For your IT team
District security reviews
We know districts have procurement and IT review requirements. We're prepared to complete security questionnaires, provide documentation on data handling practices, sign data processing agreements, and work with your IT and compliance teams directly.
What we can do for your review
- Complete security questionnaires
- Provide documentation on data handling practices
- Sign data processing agreements
- Work with your IT and compliance teams directly
Everything procurement asks for, in one place
Our Trust Center is where security reviewers self-serve: controls, policies, the SOC 2 report, and procurement paperwork, kept current.
- Security overview and controls
- Policies and SOC 2 report access
- W-9, DPA, and sole source letter
Questions
Common questions
The answers IT, compliance, and procurement teams ask for most often.
Who hosts your infrastructure?
Google Cloud Platform (GCP).
Do you have access to our student data?
Our team does not access your student data in the normal course of operations. Any access for support or maintenance is limited to the minimum required and fully logged.
What happens if there's a data breach?
We maintain incident response procedures and will notify affected users and districts promptly in accordance with applicable laws.
Can we get a copy of your security policies?
Yes. Contact us and we'll share relevant documentation for your review.
Do you carry cyber liability insurance?
Yes.
Is SageReport FERPA or HIPAA compliant?
Both frameworks apply, depending on who you are. For districts, evaluation reports and IEPs are education records under FERPA, and SageReport operates as a school official under your district's direct control, bound by the data privacy agreement we sign with you. For private practices, HIPAA typically applies, and we sign a Business Associate Agreement with those accounts. No agency certifies vendors under either law, so we point reviewers to those agreements and to our SOC 2 report rather than to a badge.
Report a vulnerability. If you discover a security vulnerability, please contact us at security@sagereport.com. We will acknowledge reports within 5 business days and ask that you give us reasonable time to address issues before any public disclosure.security.txt
Questions about security?
We're happy to discuss your district's specific requirements.