Security
IEP Co-Pilot is built for K-12 special education teams. We take protecting your data — and the trust of the families you serve — seriously. Here's how.
Encryption everywhere
TLS 1.2+ in transit. AES-256 encryption at rest for the database and backups.
Row-level security
Every database table enforces per-user access policies. Users only see their own students and IEPs.
Least-privilege access
Production secrets are scoped, rotated, and never exposed to the browser. Service-role keys live server-side only.
AI data handling
Inputs sent to AI providers are processed under enterprise contracts that prohibit training on customer content.
Backups & uptime
Automated daily database backups with point-in-time recovery.
Incident response
We notify affected users without undue delay and within 72 hours of confirming a qualifying incident.
Compliance posture
We align our practices with FERPA and COPPA. See our FERPA statement. Districts requiring a signed Data Privacy Agreement (DPA) can contact districts@brightstepsbehavior.com.