SPEDScribe Security Questionnaire

Pre-filled responses for district IT and compliance teams. Generated from spedscribe.ai/security.

This document is provided for informational purposes during our pre-launch period. A comprehensive, attorney-reviewed version will be published prior to the platform processing student data.

1. What encryption standards does SPEDScribe use?

Data stored on SPEDScribe infrastructure is encrypted at rest with AES-256 by Supabase, our database provider. That figure covers data we store. Data held by our subprocessors, including audio at our transcription provider and the inputs and outputs our AI provider retains briefly, is listed on our subprocessors page and described in the retention answer below; we do not state a cipher on their behalf. Connections to SPEDScribe are encrypted with TLS 1.2 or higher, and TLS 1.3 with current browsers.

2. Where is student data stored and how is it protected?

Student data stored by SPEDScribe is held in Supabase (US West region); audio reaches our transcription subprocessor and redacted text reaches our AI provider, both listed on our subprocessors page. Encryption at rest is managed by Supabase, which generates and manages the encryption keys, and automated daily backups are retained on a seven-day rolling window.

3. What is SPEDScribe's data retention policy?

Session data is retained for the duration of the service agreement. Upon contract termination, districts may request deletion on the schedule described in our Data Processing Agreement. Audio is not retained by SPEDScribe after transcription; AssemblyAI's audio retention behavior follows their published policies and our contract terms. Anthropic, our AI provider, retains inputs and outputs briefly for abuse detection and to meet legal obligations under their commercial terms before deletion; SPEDScribe does not hold a Zero Data Retention enterprise agreement.

4. How does SPEDScribe handle PII in transcripts?

Before text reaches our AI model, our servers run an automated redaction pass that replaces names and other identifiers it detects and keeps clinical terms such as assessment names. Dictated notes are also redacted by our transcription service first. If the server-side pass fails, nothing is sent to the AI model. Our audit log records how many identifiers each redaction layer replaced. Districts cannot view these records in the product today. This is reduction, not guaranteed elimination; over-redaction risk against real California special-education proper nouns is not fully validated.

5. Who has access to student data?

Access is role-based. Providers sign in with a Google or Microsoft account, or with an email address and password. District-enforced single sign-on (SAML) is not available today.

6. How does SPEDScribe handle security incidents?

SPEDScribe provides FERPA breach notification without unreasonable delay, written district notification within 72 hours of confirmed breach discovery, and a written root cause analysis and remediation report within 30 days.

7. Does SPEDScribe's AI partner store or train on student data?

Our AI provider (currently Anthropic) does not use customer inputs or outputs to train models under their commercial terms. They retain inputs and outputs briefly for abuse detection and to meet legal obligations before deletion. SPEDScribe does not currently hold a Zero Data Retention enterprise agreement with Anthropic; standard commercial retention behavior applies.

8. What are SPEDScribe's subprocessors?

Our subprocessors, what each one receives and where each one operates are listed at spedscribe.ai/subprocessors.

9. Which compliance frameworks does SPEDScribe align with?

SPEDScribe operates under FERPA and processes student data only at the direction of the contracting district. We comply with SOPIPA (no advertising or commercial profiles) and AB 1584 (California Education Code 49073.1). SPEDScribe is not a HIPAA covered entity by default and has not signed a BAA.