SPEDScribe Security Questionnaire

Pre-filled responses for district IT and compliance teams. Generated from spedscribe.ai/security.

1. What encryption standards does SPEDScribe use?

SPEDScribe uses AES-256 encryption for all data at rest and TLS 1.3 for all data in transit, including connections to AI processing partners and SSO providers.

2. Where is student data stored and how is it protected?

All student data is stored in Supabase (US West region) with row-level security policies. Providers can only access their own sessions; district directors can only access their own district's data. Dedicated key management and point-in-time recovery backups are enabled.

3. What is SPEDScribe's data retention policy?

Session data is retained for the duration of the service agreement. Upon contract termination, districts may request deletion on the schedule described in our Data Processing Agreement. Audio is not retained by SPEDScribe after transcription; AssemblyAI's audio retention behavior follows their published policies and our contract terms. Anthropic, our AI provider, retains inputs and outputs briefly for abuse detection and to meet legal obligations under their commercial terms before deletion; SPEDScribe does not hold a Zero Data Retention enterprise agreement.

4. How does SPEDScribe handle PII in transcripts?

Every transcript passes through a layered server-side PII scrubbing pipeline before reaching AI processing. Layer 1 (AssemblyAI) uses ML-based PII detection on the transcript it returns at transcription time. Layer 2 is a SPEDScribe server-side scrubber implemented natively in Node.js: seven custom pattern detectors target person names (title-prefix, context, possessive, speaker-label patterns), SSNs, phone numbers, email addresses, addresses, DOBs (context-keyword windowed), and student IDs, plus a local proper-noun detector based on the wink-eng-lite-web-model (MIT-licensed, in-process, no external API) for bare given-and-surname spans. A clinical allowlist preserves assessment and therapy terminology. The pass is fail-closed: any detector exception aborts the call. Both layers log redaction counts by category for auditing. This is reduction, not guaranteed elimination; over-redaction risk against real California special-education proper nouns is not fully validated.

5. Who has access to student data?

Access is role-restricted via RBAC. Providers see only their own sessions. Directors see only their district. Administrative staff are separated from production student data. SSO/SAML 2.0 is supported via Google Workspace today; Clever and ClassLink SSO integrations are planned for pilot rollout.

6. How does SPEDScribe handle security incidents?

SPEDScribe provides FERPA breach notification without unreasonable delay, written district notification within 72 hours of confirmed breach discovery, and a written root cause analysis and remediation report within 30 days.

7. Does SPEDScribe's AI partner store or train on student data?

Our AI provider (currently Anthropic Claude) does not use customer inputs or outputs to train models under their commercial terms. They retain inputs and outputs briefly for abuse detection and to meet legal obligations before deletion. SPEDScribe does not currently hold a Zero Data Retention enterprise agreement with Anthropic; standard commercial retention behavior applies.

8. What are SPEDScribe's subprocessors?

Key subprocessors include AssemblyAI (speech-to-text, US-based, under data protection contract terms), Anthropic (AI processing, commercial terms with no training on customer data; SPEDScribe does not hold a Zero Data Retention enterprise agreement), Supabase (database hosting, US West, independently SOC 2 Type 2 attested), and Vercel (web infrastructure, independently SOC 2 Type 2 attested). Full subprocessor list available at spedscribe.ai/subprocessors.

9. Which compliance frameworks does SPEDScribe align with?

SPEDScribe operates under FERPA and processes student data only at the direction of the contracting district. We comply with SOPIPA (no advertising or commercial profiles) and AB 1584 (California Education Code 49073.1). Formal FERPA classification (including any 'school official' designation), COPPA framing, and CCPA/CPRA disclosures are under attorney review and will be detailed when complete. SPEDScribe is not a HIPAA covered entity by default and has not signed a BAA.

10. Does SPEDScribe conduct penetration testing?

Yes. Independent third-party penetration testing is planned; we will share the schedule and results with districts under NDA once dates are set. Ongoing vulnerability scanning is performed on all infrastructure.