Four questions IT asks. Four real answers.
Plain English. No "we take security seriously" filler. If we don't have the audit yet, we say so — and we tell you what we do have.
Straight answers. No "we're SOC2 in progress" theatre.
FERPA — how do you handle student records?
Berdee treats every attempt, score, and roster entry as a student record under FERPA. Educator and student access are separated by role. Data we capture is owned by your district / educator account — exportable on request. We act as a school official with legitimate educational interest when used in K-12 contexts. We don't sell data, we don't train AI on student responses, and we don't enrich student profiles with third-party tracking.
COPPA — what about kids under 13?
Children never sign up themselves. Their teacher adds them, by email or from Google Classroom, and each student opens lessons with their own code or link, with no password and a robot avatar instead of a photo. We store each student's name and email (and, for Google Classroom imports, their Google account ID). Consent comes one of two ways: a school authorizes use for its students under the COPPA school-consent framework, or a parent adds their own children. So only teachers and staff acting for a school or district, and parents, may add students. Private tutors and therapists who aren't working for a school can't add students until Berdee offers a way for parents to consent directly.
Accessibility — does it actually work for students with IEPs?
Student screens are built to WCAG 2.1 AA, and an independent audit is planned. Dyslexia-friendly fonts (OpenDyslexic, Lexend, Atkinson Hyperlegible) are built in, and an educator can set one for a whole lesson or for any text. A visible outline shows where you are on every button and control. Large touch targets on phones and tablets. Colors chosen to meet AA contrast. Every student activity works with a keyboard.
Data residency — where does this live?
Production is on Cloudflare Workers (edge-deployed globally) with a PlanetScale Postgres primary in US-East. We don't currently offer EU-only or US-only residency contracts — if that's a district requirement, talk to us before signing. The database is backed up automatically by PlanetScale, our database provider.
The docs you can request now — and the ones we're working on.
Procurement questionnaires welcome. If you need a specific form (vendor security review, district DPA, state-specific addendum), email us and we'll tell you what we can sign or complete today.
We can share now
- Student privacy policy (COPPA / FERPA) (public)
- Privacy policy, with the subprocessor list (public)
- Terms of service (public)
- Data flow diagram (on request)
- Subprocessor list (on request)
- FERPA / COPPA position statement (on request)
We're working on
- Formal third-party penetration test report — planned
- State-specific student-data agreements (NY-Ed Law 2-d, CA SOPIPA, etc.) — case by case
We won't pretend these exist before they do. If you're a district that needs one of these to move forward, tell us and we'll prioritize accordingly.
The product is used by young learners and IEP students.
Accessibility is a rule we build by, not a box we tick at the end. What students see is built to WCAG 2.1 AA, the accessibility standard schools use, and an independent audit is planned.
- Built to WCAG 2.1 AA; independent audit planned
- OpenDyslexic font built in
- 44px touch targets on mobile (kids on tablets matter)
- Focus-visible rings on every interactive — keyboard-navigable
- OKLCH color contrast checked at design time, not after
- Deterministic robot avatars — no profile photo / upload required
Need a DPA or vendor questionnaire?
Reach out and we'll respond with what we can share today and what's in progress.