---
title: "FERPA Compliance"
description: "Is Brainfish FERPA certified?"
canonical_url: "https://help.brainfi.sh/articles/ferpa-compliance-tmdDFy5YhY"
md_url: "https://help.brainfi.sh/articles/ferpa-compliance-tmdDFy5YhY.md"
---
# FERPA Compliance

## Is Brainfish FERPA certified?

FERPA (Family Educational Rights and Privacy Act) is not a certification — it is a US federal law that places obligations on educational institutions to protect student education records. There is no formal FERPA certification body. Instead, institutions must assess whether their vendors' data handling practices are consistent with FERPA requirements.

## Brainfish's compliance posture for education customers

Brainfish takes student data privacy seriously and has the following security and compliance measures in place:

* Registered in **SAM.gov**
* Active **CAGE Code**
* **SOC 2 Type II** audited
* **GDPR** compliant

While FERPA is not a certification, our platform is designed to support customers in meeting their FERPA obligations when handling education records. We are happy to discuss our privacy controls, security measures, and contractual commitments — such as a Data Processing Agreement or FERPA-related provisions — to meet your institution's requirements.

## Features that support FERPA obligations

### Access control & data isolation

* Role-based access control (RBAC) restricts who can access content
* Content isolation keeps internal collections private — they never surface to public-facing agents
* Full audit log of every integration, edit, approval, and publish action

### PII protection

* Automatic redaction of PII (emails, phone numbers, names) in session recordings
* Customers can define custom regex rules to obfuscate additional sensitive fields
* PII-protection feature blacks out confidential information before screenshots are taken

### Data handling

* All data encrypted in transit (TLS 1.2) and at rest
* Data segregation — each account's data is separated by unique IDs, accessible only by that customer's team
* Data deletion on request, processed promptly
* US and EU data residency options available

### LLM guardrails

* LLM Guardrails limit AI responses to approved content, preventing the model from surfacing information outside what has been explicitly sanctioned

### Tailored implementation

* Brainfish works with your team to understand your specific regulatory environment and customise the deployment accordingly

## Next steps

Contact **hello@brainfi.sh** or your Brainfish account team to discuss FERPA-specific requirements, contractual protections, or a Data Processing Agreement for your institution.