FERPA Compliance Statement

1. What FERPA Is

FERPA is a U.S. federal law that protects the privacy of student education records held by educational agencies and institutions that receive federal funding. It gives eligible students (those who are eighteen or older, or enrolled in a postsecondary institution) the right to inspect and review their records, to request corrections, and to control the disclosure of personally identifiable information from those records, subject to enumerated exceptions.

2. Vanguard SIM’s Role: “School Official”

When an accredited U.S. institution adopts a Vanguard SIM simulation for a course, Vanguard SIM acts as a “school official” with a “legitimate educational interest” in student records under the FERPA exception codified at 34 C.F.R. § 99.31(a)(1)(i)(B). In that capacity Vanguard SIM:

• Performs an institutional service (delivery, scoring, and grade-passback of a course-integrated simulation) that the institution would otherwise perform with its own employees;
• Is under the direct control of the institution with respect to the use and maintenance of education records;
• Uses education records only for the purposes for which disclosure was made, and does not re-disclose them except as permitted by FERPA;
• Is bound by the requirements of 34 C.F.R. § 99.33(a) governing the redisclosure of personally identifiable information.

3. Records We Process

The records Vanguard SIM processes on the institution’s behalf are limited to what is needed to deliver the Service:

• Student name and institutional email address.
• Course and section enrollment identifiers.
• Simulation submissions, team artifacts, response text, and LLM interactions generated within the course.
• Scoring events, rubric outputs, and final grades.
• Timestamps and technical logs associated with the above.

Vanguard SIM does not request or ingest Social Security numbers, government IDs, financial aid records, disciplinary records, or health information.

4. Institutional Custody; No Marketing Use

The enrolling institution is and remains the custodian of its students’ education records. Vanguard SIM does not use personally identifiable information from education records for advertising, targeted marketing, profile building, or resale, and does not share it with third parties for those purposes. Vanguard SIM does not use student submissions to train foundation models.

5. Directory Information

Vanguard SIM does not publish student directory information. Any designation of “directory information” under FERPA remains the institution’s to make. If an institution asks Vanguard SIM to display an item that its own policy classifies as directory information (for example, a team leaderboard showing names), Vanguard SIM will honor an opt-out request routed through the institution.

6. Subprocessors

To operate the Service, Vanguard SIM uses a limited set of subprocessors listed in the Data Processing Agreement. Each subprocessor is bound by contract to use education records only for the purposes of providing infrastructure to Vanguard SIM and is subject to the redisclosure restrictions of 34 C.F.R. § 99.33(a).

7. Access, Correction, and Deletion

Under FERPA, students exercise inspection and correction rights through their institution. Vanguard SIM will support the institution in responding to any student request by:

• Producing an export of the records Vanguard SIM holds about that student within a reasonable period after an authenticated institutional request;
• Applying corrections to records at the institution’s written direction;
• Deleting records at the institution’s written direction, or upon the expiration of the retention period specified in the Privacy Policy.

8. Retention and Deletion Procedures

Education records are retained for twenty-four (24) months after the end of the course offering unless the institution requests a different retention period. At the earlier of contract termination, retention expiry, or a documented deletion request, Vanguard SIM performs a hard delete of primary records within thirty (30) days and confirms deletion in writing. Copies present in encrypted backups roll off according to the standard backup-rotation schedule (a maximum of ninety (90) days) and are not restored except in a disaster-recovery event.

9. Security Safeguards

Vanguard SIM protects education records with encryption in transit (TLS 1.2+) and at rest (AES-256 via Supabase), row-level security on every application table, least-privilege administrative access gated by an allowlist, audited privileged actions, and prompt patching of dependencies. Suspected unauthorized access is treated as an incident under the breach notification terms of the DPA.

10. Institutional Agreements

Institutions that require signed FERPA and data-protection terms beyond this public statement may execute Vanguard SIM’s standard Data Processing Agreement or negotiate an institution-specific addendum in the order form.

11. Contact for FERPA Inquiries

Institutional FERPA questions, data-subject requests routed by an institution, and requests for a signed institutional agreement should be sent to legal@vanguardsim.com. Students should contact their institution’s registrar or privacy office first; Vanguard SIM will support the institution’s response.