Row-level security on every table
All 40 tenant tables enforce org-scoped Postgres row-level security. Access is decided by the database, not by application code remembering to check.
Security
Enforced by the system, not by promise.
Every student record is isolated to its own organization at the database.
Every server call is authorized from the signed-in token, never from the
request. Every AI request is de-identified before it leaves, every change
lands in an append-only log, and a whole record can be exported or deleted
on request. Nine automated checks test all of it whenever the code that
touches it changes, and again every week.
Follow one record through the product
Choose a station to see what stands at that step, and which check proves it.
At this step:org-scoped · RLScaller known from the tokende-identifiedappend-onlythe whole record
StudentMaya R.STUDENT_1
Case managerD. AlvarezSTAFF_1
Present levelsReads grade-level text with 68% accuracy across three probes; Jordana peer reads with her in a small group.
Guardian phone(904) 555-0142[redacted]
09:41:08ai_draftpresent_levels · model saw STUDENT_1
09:44:52ai_editpresent_levels · 1 sentence changed
09:45:10ai_approvepresent_levels · reviewed by STAFF_1
Sample record. Nothing here is a real student.
01 · Database
Row-level security decides who sees it
All 40 tenant tables enforce org-scoped Postgres row-level security. A teacher reads only the students on their team, and the database enforces that, not application code remembering to check.
verify:rls signs in as a real teacher and confirms they cannot read another organization's records, or a student off their team.
02 · Function
The caller is known from the token, never the request
Every server function verifies who is calling from their signed-in token. An id in a payload is a claim, not a permission.
verify:authz calls every deployed function without signing in, and with another organization's student wherever a function takes one, and expects a refusal each time.
03 · AI boundary
The model never sees a name
Before any request reaches Claude, student-identifying fields become placeholders, another student in free text becomes "a peer", and contact identifiers are redacted. The real values are restored only after the response returns. Scanned images, which cannot be de-identified this way, stay behind an explicit authorization record.
verify:privacy fails the build if a column could hold a category Florida prohibits (§ 1002.222), or if any module but the one gate can send an image to the model.
04 · Audit
Every access and every AI-assisted change is written down
The log is append-only: a draft, an edit and an approval each leave a row that cannot be edited after the fact, marked as AI or human. It is visible to the account it is about, on request.
verify:rls also checks that a signed-in person can write an audit row as a person, and never as the system.
05 · Export
The whole record leaves, or none of it stays
A family's full record can be exported, and a deletion request removes it, including the cross-references most systems miss. Both directions run against the live schema, not written once.
verify:parent and verify:deletion export as a real linked parent and count the rows independently of the export; purge a student and assert nothing is left behind, audit rows and signatures included.
Choose any station, or step through.
Another child's name, caught at the keyboard
A behavior note about one student often names another. The product notices as you type, and offers the fix in one click.
Behavior record · Maya R.Sample
Setting
Centers, 10:20
Antecedent
A peer asked for the blocks Maya was using and reached for the bin.
Behavior
Maya pushed the bin off the table and said no.
Consequence
Teacher moved a peer to the next table. Maya rejoined the group after two minutes.
“Sebastian Bailey” matches another student in your school
— also written here as “Sebastian”.
Write this out as "a peer"“A peer” keeps this record shareable with the family without a review first. You can leave the name if it belongs here — nothing is blocked, and saving is not delayed.
“Sebastian Bailey” was written out as “a peer”. Nothing is saved until you save.↶ Undo
CancelSave record
- 1
Detected at the keyboard
The note is scanned against the school roster as it is typed, so the warning arrives while the teacher is still in the form, not months later at release. One warning per child, every form of the name listed.
- 2
One click, “a peer”
The replacement runs across every field of the form, longest form first, so “Sebastian Bailey” never becomes “a peer Bailey”. Nothing is blocked and saving is not delayed; a name that belongs there can stay.
- 3
Caught again at release
Under IDEA's records rule (34 CFR § 300.615) that sentence is also the other child's record. Any name that stays is shown to the reviewer before a family copy goes, and it leaves redacted.
[name redacted — 34 CFR 300.615]
The same detector runs on the web and phone forms, and the release-time review reads it ungrouped, so grouping at the keyboard never hides a hit.
Control Summary
Authorization checked on every function
Every server function verifies the caller from their signed-in token, never from a value the client sent. A contract test runs against every deployed function.
De-identified before it reaches the AI
Student-identifying fields are replaced with placeholders before any request reaches Claude and restored only after the response returns. Scanned images, which cannot be de-identified this way, sit behind an explicit authorization record.
No prohibited data, verified
Florida law (§ 1002.222) prohibits collecting political affiliation, voting history, religious affiliation and biometric identifiers. IEPeasyhub holds none, and a build fails if one ever appears.
Export and deletion, both asserted
A family's full record can be exported, and a deletion request removes it, including the polymorphic references most systems miss. Both are tested against the live schema.
An append-only audit log
Every access and every AI-assisted change is recorded and cannot be edited after the fact. Visible to the account it is about, on request.
No trackers, no ad tech, anywhere
Cookieless Cloudflare Web Analytics on this marketing site and nothing else. The product carries no third-party tracker, no session replay and no advertising.
No student sign-in
Students never create an account or authenticate. Only staff and, where invited, parents do. That structurally narrows what COPPA has any bearing on.
In Progress
We would rather say it plainly than let an evaluator assume the worst, or assume a claim we cannot back.
An independent third-party assessment
On the roadmap, not yet complete. The checks above are ours; an outside reviewer's report is not yet in hand.
A district-facing Data Processing Agreement
Being drafted. Until it is signed, real student records stay behind your district's own authorization.
