Student records stay on the district’s devices.
There is no copy on a vendor’s server. The records sit on your machines, encrypted. Sending any of them out needs a destination your district configures and an agreement your district records.
Three things a reviewer can check
6 components hold student data and every one of them sits on hardware your district owns. Between the disk and a child’s name stand 600,000 rounds of PBKDF2-HMAC-SHA256, with the record itself under AES-GCM-256 and the key non-extractable and resident on that device only. Before anything can be sent anywhere, 2 things your district controls have to be true at the same time — an address you configured, and a data-protection agreement recorded in the system.
A laptop on a desk in a school office
- You open the app on a district laptop.
- As shipped, every student record stays on that machine, encrypted, and no server is involved in making it work.
- A student transfers to a district on the other side of the state.
- You send one file. It is encrypted, and it opens with the export password your district set in Settings — a device passphrase, separate from any district login.
- Your district decides it wants audit records sent to a server it runs.
- Nothing sends until two things are true: an https address for that server, entered by your district, and a data-protection agreement recorded in the system. Until both, the tiers that carry student names step down and stay put.
The honest version: CetusEd can send data to a district destination. That path ships switched off, and the only people who can switch it on are you.
The clocks and the charts run on the laptop
Every deadline counted, every pipeline opened, every progress chart redrawn and every alert raised happens on the machine in front of you, with no request going anywhere. Districts are usually asked to pick between a system that coordinates the work and a system that keeps the records in the building. This one does the coordinating in the building.
Miss either condition and the transfer stops
Without both the configured address and the recorded agreement, anything carrying a student’s name or ID is held back and the send does not happen. A second check sits further down the path, written separately from the first, so a bug in one cannot open the door quietly while the other is looking elsewhere.
Documents a reviewer can ask for
These are the company's current legal and security documents. They are sent on request rather than posted here, so a district reviewer gets the version that applies to them along with somebody to ask about it.
- Terms of Service
- Privacy Policy and Acceptable Use Policy
- Subprocessor List
- VPAT / WCAG 2.1 AA accessibility conformance report
- Information Security Policy
Ask by email and I will send them. If you need something that is not on that list, I will tell you whether it exists yet rather than sending the nearest thing that does.