Controls instead of badges
No federal body grants a certification for FERPA or for COPPA, for any company. So instead of a wall of badges, IEPeasyhub describes the controls it has actually built and how each one is checked. Most of them are verified by automatic checks, and a change reaches schools only through the automatic release process, never by hand from someone's computer. Where something is not finished, this page says so.
Who can reach a record
Access to a student's record is decided by the database itself, not by the application remembering to check. Every table that holds a school's data is scoped to its organization, so one district's records cannot be reached from another's. Inside an organization, a staff member reaches a student through that student's IEP team, and roles narrow what each person can change. A related-service provider, for example, can read the record and log services for students on their team, but cannot change goals, evaluations or eligibility.
Every request checks who is asking
Every action on the server identifies the caller from their signed-in session, never from a value the request claims about itself. An id sent in a request is treated as a claim to check, not as permission. This is enforced by an automatic test that calls every server function as an outsider and as a user from another organization, and fails if any function answers when it should refuse.
Signing in
People sign in with a one-time link or code sent to their email, and may add a password of their own. They can also use passkeys, which use the device's own screen lock instead of a password. Sign-up includes a human check that stops automated accounts. Students never create an account or sign in to IEPeasyhub; only staff and, where invited, parents and guardians do, which on its own narrows what the children's online privacy law has any bearing on.
The data Florida forbids
Florida law, section 1002.222 of the statutes, forbids collecting a student's political affiliation, voting history, religious affiliation or biometric information. IEPeasyhub holds none of these. The fields do not exist, and an automatic check fails if one ever appears. Every printed document also carries Florida's student-records disclosure lines.
No trackers and no advertising
The product carries no third-party trackers, no session-recording tools and no advertising technology of any kind. The marketing website uses only a cookieless page counter. Data is encrypted in transit and at rest, and the people who run IEPeasyhub reach student data only through the same access rules as everyone else, with the server's most powerful access kept to the few jobs that need it.
Export, deletion and the audit log
A family's full record can be exported, and a district's request to dispose of a student's record removes it, including the harder-to-reach references many systems miss. Both directions are tested automatically. Every access and every AI-assisted change is written to an audit log that cannot be edited afterward, and it shows whether a person or the AI made each change.
What is still in progress
An independent third-party security assessment and a formal data processing agreement written for districts are both planned and not yet complete. IEPeasyhub would rather say that plainly than let a district reviewer assume the worst. A district with a question this page does not answer can send it through the contact page and receive an answer in writing.
