Student records stay in your hands.
Districts and practices ask three things: where does student information go, who can see it, and what do you promise in writing. This page answers the first two. The district data agreement is the written promise.
There is no such certificate.
FERPA is a federal law about education records. No government office certifies software against it, and a vendor who says "FERPA certified" is describing itself. What a district can fairly ask for is a plain description of how records are handled and a signed agreement. You have both here.
The same is true of HIPAA: it is a law, and there is no official HIPAA certification either.
Four commitments.
- Identifying student information stays in your own files — on your computer and in your own Google Drive and Google Sheets. We keep no database of student records.
- When you use AI drafting, the app sends text with names and identifiers removed. It passes through our server to the writing service and our server does not save it.
- We never sell student information, use it for ads, build profiles from it, or use it to train AI models.
- The psychologist stays in charge. Every draft is a proposal that you review, change, and sign.
Follow the data.
Score reports, records, notes, finished reports
They live on your computer and in your own Google account. They are not uploaded to us.
AI drafting text, identifiers removed
Your app sends it to our server. Our server forwards it to Anthropic's Claude writing service and returns the draft to you. We do not save it. Anthropic processes it to write the draft under its own terms.
Sign-in and subscription
Google tells us your email address and name when you sign in. We check the email against our subscriber list. That list holds the email, the date your plan is paid through, and short account notes.
This website
Our host, Cloudflare, keeps standard server logs. Forms you fill in on this site are saved to a private Google Sheet so we can reply. Please do not type student information into any form or into the site chat.
The "school official" rule.
FERPA lets a school share education records with a vendor, without parent consent, when the vendor is treated as a "school official": it does a job the school would otherwise do with its own staff, it is under the school's direct control for how it uses and maintains the records, and it uses the records only for that job (34 CFR 99.31(a)(1)).
AUTOMATA is built so that we do not need identifiable records at all. If your district wants those protections in writing anyway, the district data agreement says it. This page is information, not legal advice; your district's counsel decides how FERPA applies to you.
Who else is involved.
- Google — sign-in, and the Drive and Sheets accounts that hold your files.
- Cloudflare — hosts this website and the server that checks your subscription.
- Anthropic — the AI writing service that turns de-identified drafting text into a draft.
- Stripe — card payments, once paid plans open. It never touches student information.
Schools and practices differ.
HIPAA covers health plans and health care providers. Records a school keeps about its students are education records under FERPA, not HIPAA. If your private practice is a HIPAA covered entity, email us before you put protected health information into any tool, and we will tell you plainly what AUTOMATA does and does not do.
Not yet.
We do not currently hold a SOC 2 report. A SOC 2 audit examines how a company protects the customer data it holds, and we hold no student records. If your district requires one, tell us.