- SOC 2 audited by CertPro
- Built for FERPA and HIPAA
- BAA available
Security and compliance, built for student data.
How we protect student data, and the documents your IT and procurement teams will ask for.
Our commitments
What we commit to
SageReport handles sensitive student information. We treat that responsibility seriously.
This page explains how we protect your data, what compliance measures are in place, and what we're working toward. If you have questions not covered here, contact us.
Your data is never used to train AI
We do not train any AI models on your data. Your cases, reports, and student information are used only to provide the service to you, nothing else.
We don't access your data
Our team does not access your student data in the normal course of operations. When access is necessary for support or maintenance, it is limited to the minimum required and fully logged.
Secure cloud infrastructure
All data is stored on Google Cloud Platform (GCP) in the United States, with enterprise-grade security controls.
Encryption everywhere
Data is encrypted in transit (TLS) and at rest (AES-256). Access controls and comprehensive audit logging cover data access and administrative actions.
You control your data
Export your reports anytime. Delete cases when you choose. If you close your account, data is kept for a short recovery window (30 days for personal accounts, 90 days for district accounts), then permanently deleted, except where the law or your agreement requires us to keep something.
Compliance status
Where we stand
SageReport is built to meet the standards school districts require. Here's our current status.
| Standard | Status |
|---|---|
| FERPA (school official designation, district DPA) | In place |
| BAA with Google Cloud | In place |
| HIPAA-aligned (Business Associate), BAA available | In place |
| SOC 2 Type IAudited by CertPro, with a clean report. | Complete |
Our SOC 2 Type I report is available under NDA through the Trust Center.
FERPA compliance
For districts, SageReport operates as a school official under FERPA: under your direct control, using education records only for the contracted purpose, with no redisclosure. Those terms are set in the data privacy agreement we sign with each district.
We maintain the administrative, technical, and physical safeguards required for handling student education records.
If your district requires specific documentation or agreements,contact us and we'll work with your team.
For your IT team
District security reviews
We know districts have procurement and IT review requirements. We're prepared to complete security questionnaires, provide documentation on data handling practices, sign data processing agreements, and work with your IT and compliance teams directly.
What we can do for your review
- Complete security questionnaires
- Provide documentation on data handling practices
- Sign data processing agreements
- Work with your IT and compliance teams directly
Everything procurement asks for, in one place
Our Trust Center is where security reviewers self-serve: security controls, the SOC 2 report (under NDA), and procurement paperwork, kept current.
- Security overview and controls
- SOC 2 Type I report, under NDA
- W-9, DPA, and sole source letter
Questions
Common questions
The answers IT, compliance, and procurement teams ask for most often.
Who hosts your infrastructure?
Google Cloud Platform (GCP).
Do you have access to our student data?
Our team does not access your student data in the normal course of operations. Any access for support or maintenance is limited to the minimum required and fully logged.
What happens if there's a data breach?
We maintain incident response procedures and will notify affected users and districts promptly in accordance with applicable laws.
What security documentation can we review?
Our Security & Privacy Overview summarizes our whole security program, and we'll complete your district's security questionnaire. Our SOC 2 Type I report is available through the Trust Center once you sign an NDA, and our latest penetration test report is available on request, also under NDA. Our information security policies stay internal: we list them for you by name and cite the relevant one in our answers (for example, our Incident Response Plan). Contact us and we'll put together what your review needs.
Do you carry cyber liability insurance?
Yes.
Is SageReport FERPA or HIPAA compliant?
Both frameworks apply, depending on who you are. For districts, evaluation reports and IEPs are education records under FERPA, and SageReport operates as a school official under your district's direct control, bound by the data privacy agreement we sign with you. For private practices, HIPAA typically applies, and we sign a Business Associate Agreement with those accounts. No agency certifies vendors under either law, so we point reviewers to those agreements and to our SOC 2 report rather than to a badge.
Report a vulnerability. If you discover a security vulnerability, please contact us at security@sagereport.com. We will acknowledge reports within 5 business days and ask that you give us reasonable time to address issues before any public disclosure.security.txt
Questions about security?
We're happy to discuss your district's specific requirements.