FERPA is the US law that protects the privacy of student education records. If your school uses our products, the content your people upload may include those records. FERPA lets a school share education records with an outside company like us — without asking each student first — only when the school treats that company as a “school official” under 34 CFR §99.31(a)(1)(i)(B).

That call is your school’s to make, not ours. FERPA binds schools, not vendors, and only your school can designate a school official. What we can do is agree to the terms that make the designation work — and our Data Processing Addendum (DPA) already carries every one of them. Here is how our terms line up with the rule:

1. We do a job you’d otherwise do yourselves. You use our software to run work your school would otherwise handle with its own staff and tools. That is the “institutional service or function” the rule describes. Our only role with your data is to provide that service — nothing else (DPA §2.1 and Schedule 1).

2. You stay in control. We only handle your data to do what you’ve told us to, on your documented instructions, and for no other purpose (DPA §2.3.1). You can step in and stop any processing you didn’t authorize (DPA §6.3). And when you’re done, you get your data back and we delete it (DPA §8). That is the “direct control” over use and maintenance of records that FERPA asks you to keep.

3. We use your data only for you, and we don’t pass it on. We don’t keep, use, or share your data outside our direct business relationship with you (DPA §2.3.3.iii). We never sell it, and never share it for advertising (DPA §2.3.3.i). Our people are bound by confidentiality (DPA §4.1), and any subprocessor we rely on is held to terms no less protective than these (DPA §5.1). That is what §99.33(a) requires: no re-disclosure without consent, and use only for the purpose you shared the data for.

Our commitment. If your school designates 37signals as a school official with a legitimate educational interest, we accept that designation, and we agree to use and maintain education records under the conditions of 34 CFR §99.33(a). Your FERPA office still makes the determination; this statement shows our terms support it.

This statement mirrors Section 12 of our Data Processing Addendum, which is where the commitment binds.