Security & privacy
Student data, plainly explained
Our commitments, the security standards SubjectPath runs on, what we collect, who can see it, and how accounts are protected.
Our commitments
We never sell student data
We never sell student data or use it for advertising.
We sign data privacy agreements
We sign district data privacy agreements, including state templates.
You own your data
Your district owns its data. We process it only to provide SubjectPath.
Deletion on request
You can ask us to delete your district’s data.
Standards
Security standards
Built to SOC 2 controls
SubjectPath follows the same SOC 2 framework controls as every product we build, covering security, availability, processing integrity, confidentiality and privacy.
Independent assessments
Independent security assessments check our adherence to industry practices.
FERPA ready
SubjectPath is designed to help districts maintain FERPA compliance for student data.
Infrastructure
The standards SubjectPath runs on
Encryption
Connections are encrypted with TLS, and sensitive data and personal information are encrypted at rest.
Secure hosting
SubjectPath runs on Linode (Akamai) and AWS, with database encryption required for sensitive information.
Monitoring and logging
Activity logging with alerts for suspicious activity.
Vulnerability scanning and testing
Regular vulnerability scanning and penetration testing across systems, networks and applications.
Backups and recovery
Backup and disaster recovery procedures protect your data and keep SubjectPath available.
What we collect
- Account and roster information
- Names, email addresses, school and district, roster IDs, grade level, each user’s role, and when each account last signed in.
- Responses
- Students’ answers to questions and how long each answer took.
- Results
- What the diagnostic derives from responses: placements, skill mastery and misconception patterns.
Who can see it
Customer access is based on each person’s role, and limited to their own scope.
| Role | Can see |
|---|---|
| Students | Their own work and results. |
| Teachers | The students in their classes. |
| School administrators | Their own school. |
| District administrators | Their own district. |
Access
How access works
Access follows each person’s role
Requests for student data are checked on our servers against the person’s role and scope, so teachers work with their own classes and administrators with their own school or district.
Students answer only for themselves
Only a student can submit answers to their own diagnostic and skill checks.
Districts stay separate
A district or school can’t request another’s data. Requests outside someone’s scope are refused.
How accounts are protected
Passwords are hashed
Passwords are stored only as salted, one-way hashes, never as plain text.
Reset links expire
Password reset links work once and expire after 60 minutes. Resetting a password signs that account out everywhere.
Sessions time out
Sign-in sessions expire after 24 hours.
Deactivation takes effect right away
When an account is deactivated, its access ends immediately.
Built with care
Errors stay quiet
Error messages are designed not to reveal system details.
Safer spreadsheet exports
Exported spreadsheets are designed to guard against formula injection.
No trackers, no AI scoring
As the product is built today, it includes no advertising or analytics trackers, and no AI scores student answers.
Our people and practices
- Security awareness training for every employee
- Background checks, including criminal screening and employment verification
- Confidentiality policies with regular review
- Defined roles and responsibilities across development, security and operations
- Secure software development practices
Questions or reports
Security questions and vulnerability reports: security@subjectpath.com
Privacy questions and data privacy agreement requests: privacy@subjectpath.com
Questions about student data?
Ask us about our data privacy agreement, or see SubjectPath with your team.