Security at ClassLens
Built so districts can say yes.
SOC 2 Type I attested. Google CASA Tier 2 verified. Federal CISA Secure by Design Pledge signatory. Google-approved Zero Data Retention on our Vertex AI project. Student work is processed transiently and deleted as soon as you release the grades.
Audited by Percilchofe CPA LLC (License No. 1188). Report dated April 4, 2026, available under NDA. Most ed-tech vendors won’t name their auditor.
What districts ask us first.
Where does student work live?
Inside Google Classroom, where your teachers already keep it. Submissions transit our infrastructure long enough to be graded: each file is staged in a private Google Cloud Storage bucket for AI processing and best-effort deleted afterwards, with a 24-hour bucket lifecycle policy as the failsafe. While the job runs, submission metadata and per-student results sit in an encrypted Redis job cache. It is cleared once the job finishes successfully; a job that ends incomplete keeps its cache so the work is recoverable, and either way the 48-hour expiry is the outer bound. In Grade & Review mode the drafted grades and feedback wait in a separate review queue, alongside a short-lived copy of the submission files so you can read them while reviewing; both are deleted when you release the grades, with a 24-hour expiry as the failsafe. The draft grade itself is written to Classroom during grading, not afterwards. Once a job’s results are released or expire, ClassLens deletes the student submission content, grades and AI-generated feedback it held; the staging delete is best-effort, so the 24-hour bucket lifecycle policy is what guarantees a failed delete does not outlive it.
Read the full FERPA posture →Who has reviewed your security?
A licensed CPA firm (Percilchofe CPA LLC, License No. 1188) issued an unqualified SOC 2 Type I opinion as of April 4, 2026. Google’s CASA Tier 2 assessment was completed by TAC Security on April 1, 2026. Google verified our OAuth scopes — including the restricted Drive scope — on April 9, 2026.
See attestations and dates →Does Google use our data to train AI?
No. ClassLens runs on Google Cloud Vertex AI under the Cloud Data Processing Addendum, which contractually prohibits Google from using customer data to train its foundation models. Zero Data Retention is enrolled — Google has formally approved a no-prompt-logging exception for our Vertex AI project. We publish this here so districts do not have to ask.
See the data flow →Attestations and verifications.
Names, dates, license numbers. No marketing adjectives.
- SOC 2 Type I
- SOC 2 Type I Attested by Percilchofe CPA LLC (License No. 1188); as of April 4, 2026; unqualified opinion. Full report available under NDA.
- Socify Letter of Validation
- Socify-issued Letter of Validation (April 27, 2026) confirming our control environment was evaluated against the applicable AICPA Trust Services Criteria and assessed for readiness for an independent SOC 2 audit. It is a readiness document, not the audit. Published openly so you can see something before signing anything; the SOC 2 Type I attestation report from Percilchofe CPA LLC is available under NDA.
- Google CASA Tier 2
- CASA Tier 2 security assessment complete (Letter of Validation submitted April 1, 2026 by TAC Security via the Google-authorized ESOF AppSec platform).
- Google OAuth verification
- Google OAuth verified (April 9, 2026), including the restricted Google Drive scope, gmail.send, and classroom.profile.emails.
- CISA Secure by Design Pledge
- Signed April 28, 2026, and listed on CISA’s public signer registry under our legal name, Evolved Academics (verified 2026-07-25). A voluntary commitment to seven security goals; CISA does not endorse or certify signatories.
- FERPA posture
- FERPA school-official posture under 34 CFR 99.31(a)(1)(i)(B); no persistent student submissions, names, email addresses, grades, or AI-generated feedback are stored on ClassLens servers.
- COPPA-aligned program
- COPPA-aligned: Written Information Security Program (WISP v1.2), Data Retention Schedule v1.2, School Consent Framework v1.1, and Privacy Policy Section 7 with specific retention timeframes are deployed.
- Model-training posture
- Google Cloud Vertex AI under the Google Cloud Data Processing Addendum (CDPA) does not use submitted data to train Google’s foundation models. Zero Data Retention is enrolled — Google has formally approved a no-prompt-logging exception for our Vertex AI project.
What is the CISA Secure by Design Pledge?
The Student Privacy Pledge — the badge many EdTech vendors displayed for a decade — was retired by the Future of Privacy Forum on April 25, 2025, after more than 40 states codified its principles into binding law. New signatories have not been accepted since that date, and the public registry of past signatories was taken offline July 31, 2025. ClassLens commits to the substantive Pledge principles in our Privacy Policy and Terms of Service.
At retirement, FPF pointed vendors toward two frameworks: the SDPC National Data Privacy Agreement (NDPA), which we have drafted vendor-side exhibits to execute, and CISA’s Secure by Design program. CISA runs two separate pledges under that program. The K-12 Education Technology Secure by Design Pledge was signed by a small group of major student information and learning management platforms. The broader CISA Secure by Design Pledge is open to all software makers and commits signers to seven concrete security goals, from multi-factor authentication to coordinated vulnerability disclosure; its registry lists hundreds of cybersecurity and technology companies. Evolved Academics signed the CISA Secure by Design Pledge on April 28, 2026. The live registry is published at cisa.gov/securebydesign/pledge/secure-design-pledge-signers.
Signing is a public, voluntary commitment, not a certification: CISA does not endorse signatories, audit them, or attest to the security of any product. We name it here because it is verifiable in one click, not because it is an award.
If your procurement rubric still asks for a Student Privacy Pledge badge, the honest industry answer is that pre-2025 signatories were grandfathered into a sunset program with no live registry, while ClassLens has aligned with the frameworks that replaced it.
See something before you sign anything.
Most vendors show you nothing until an NDA is countersigned. We publish the Socify Letter of Validation openly — a third-party confirmation that our control environment was evaluated against the applicable AICPA Trust Services Criteria and assessed for readiness for an independent SOC 2 audit. It is a readiness document, not the audit itself. The SOC 2 Type I attestation (Percilchofe CPA LLC, License No. 1188, unqualified opinion, as of April 4, 2026) is available under NDA.
Issued April 27, 2026 by Socify. ~120 KB.
Need the full report? Request it under NDA.
Where student data lives — and where it does not.
ClassLens operates as a school official under FERPA 34 CFR 99.31(a)(1)(i)(B). The school or district directs us to perform a function (grading assistance) the district would otherwise perform itself, under the district’s direct control over the use and maintenance of education records.
No persistent student submissions, names, email addresses, grades, or AI-generated feedback are stored on ClassLens servers. Only opaque Google-issued student IDs are retained for resubmission detection. Submissions transit our infrastructure to be graded and the resulting drafts are written back to Google Classroom (the district’s system of record). Operational metadata (job timestamps, token counts, error logs) is retained per our Data Retention Schedule v1.2.
Google Cloud Vertex AI under the Cloud Data Processing Addendum does not use submitted data to train Google’s foundation models.
How a student submission moves through ClassLens.
Six steps. Plain English.
- 1A teacher signs in to ClassLens with Google. Only the OAuth scopes Google has verified are used.
- 2The teacher picks a Classroom assignment and configures grading preferences.
- 3ClassLens fetches the submission from Google Classroom using the teacher's authorized session.
- 4The submission is uploaded to a private Google Cloud Storage bucket and referenced by Google Cloud Vertex AI for inference under the Cloud Data Processing Addendum. Submissions are not used to train Google’s foundation models, and Zero Data Retention is enrolled — Google has formally approved a no-prompt-logging exception for our Vertex AI project. ClassLens deletes the staged file from Cloud Storage immediately after grading; a 24-hour bucket lifecycle policy is the safety net.
- 5The draft grade is written to Google Classroom during grading in BOTH modes. In Draft Only that is the whole write-back; in Grade & Review the grade and its feedback are additionally routed to the in-app Batch Review Dashboard, and on release ClassLens marks the grade assigned in Classroom and delivers the feedback to the student.
- 6In both modes, submission metadata and per-student results sit in an encrypted job cache while the job runs; it is cleared once the job finishes successfully, a job that ends incomplete keeps its cache so the work is recoverable, and either way the 48-hour expiry is the outer bound. In Grade & Review mode the submission and its drafted results additionally sit in a review queue until the teacher releases or keeps the grades, with a separate 24-hour failsafe expiry. Deletion is attempted as soon as each step completes; the two expiries are what bound anything a delete misses. After that, only operational metadata (timestamps, token counts, error logs) is kept, per our published Data Retention Schedule.
Subprocessors.
A current list of our production vendors. The subprocessors that handle personal or student data are also described in our Privacy Policy.
| Subprocessor | Purpose | Data Category | Region |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting, MySQL, Redis | Application data, operational metadata | us-west-1 (N. California) |
| Cloudflare | CDN, DDoS, TLS termination, WAF | Network metadata | Global edge |
| Google LLC | OAuth, Classroom API, Drive API, Gmail API | Authentication, assignment + grade write-back | US |
| Google Cloud Platform | Vertex AI inference + Cloud Storage submission staging | Submission content (transient). Cloud DPA. Project-level ZDR approved by Google 2026-04-29 (Cloud project 135589175772). | us-central1 (regional) / global (model-dependent) |
| Stripe | Subscription billing | Billing identifiers, payment method tokens | US |
| GitHub | Source code and internal documentation hosting | Application source and docs; not a store of student records | US |
State student-data laws.
We adhere to the substantive privacy principles of state student-data laws including SOPIPA (California Bus. & Prof. Code 22584), AB 1584 (California Education Code 49073.1), and New York Education Law §2-d. State-specific attestations — including the New York §2-d Parents’ Bill of Rights and supplemental information disclosures — are issued upon district request as part of the contracting process. ClassLens additionally completes vendor security questionnaires for state and district frameworks (including Texas TX-RAMP-aligned questionnaires) on request. ClassLens is built on the SDPC National Data Privacy Agreement (NDPA) framework; vendor-side exhibits are drafted and ready to execute with an originating LEA, including the Exhibit E General Offer of Privacy Terms.
Engineering practices.
Encryption
All traffic is TLS 1.2 or higher in transit, terminated at Cloudflare. Application data at rest — including the MySQL data volume — sits on AWS EBS volumes encrypted with AWS KMS keys, and database backups are encrypted at rest in Amazon S3. OAuth tokens are encrypted at rest at the application layer with AES-256-GCM with a versioned key format.
Access
Production access is limited to the founder, gated by SSO and multi-factor authentication. AWS uses instance roles — no static keys. Inbound network access goes through a Cloudflare Tunnel; the AWS instance has no public inbound ports. Administrative actions are logged.
Incident response
Security incidents are handled per our Information Security Policy and our Written Information Security Program (WISP v1.2). Confirmed incidents involving district data trigger notification to the affected district within the timeframes specified in the executed NDPA or DPA — and never later than 72 hours after confirmation.
Frequently asked.
Are you "SOC 2 certified"?
Why don’t you display the Student Privacy Pledge badge?
Do you store student work?
Is ClassLens FERPA compliant?
Is ClassLens COPPA compliant?
Does Google use our submissions to train AI?
Can students see grades before our teachers approve them?
Will you sign our NDPA?
Contact.
Security questions, NDPA execution, and procurement: steven.swanson@evolvedacademics.com.
Responsible disclosure: report suspected vulnerabilities to security@evolvedacademics.com. Read our full responsible disclosure policy; machine-readable contact at /.well-known/security.txt.
Safe harbor: we will not pursue legal action against security researchers for activities conducted in good faith and consistent with our published policy. Specifically, we will not pursue claims under any of the following, including but not limited to: the federal Computer Fraud and Abuse Act (18 U.S.C. § 1030); the anti-circumvention provisions of the Digital Millennium Copyright Act (17 U.S.C. § 1201); the federal Stored Communications Act (18 U.S.C. § 2701 et seq.); California Penal Code § 502(c) and equivalent computer-misuse statutes in other U.S. states; or the federal Wiretap Act (18 U.S.C. § 2511) and equivalent state wiretap statutes, to the extent applicable. The list is illustrative and not exhaustive. We acknowledge reports within two business days and remediate per the SLAs in our incident management policy. We do not run a paid bounty program; we credit reporters who request it.
Last reviewed: 2026-07-04 • Evolved Academics, LLC • Whittier, CA