FERPA Compliance
Is Brainfish FERPA certified?
FERPA (Family Educational Rights and Privacy Act) is not a certification — it is a US federal law that places obligations on educational institutions to protect student education records. There is no formal FERPA certification body. Instead, institutions must assess whether their vendors' data handling practices are consistent with FERPA requirements.
Brainfish's compliance posture for education customers
Brainfish takes student data privacy seriously and has the following security and compliance measures in place:
- Registered in SAM.gov
- Active CAGE Code
- SOC 2 Type II audited
- GDPR compliant
While FERPA is not a certification, our platform is designed to support customers in meeting their FERPA obligations when handling education records. We are happy to discuss our privacy controls, security measures, and contractual commitments — such as a Data Processing Agreement or FERPA-related provisions — to meet your institution's requirements.
Features that support FERPA obligations
Access control & data isolation
- Role-based access control (RBAC) restricts who can access content
- Content isolation keeps internal collections private — they never surface to public-facing agents
- Full audit log of every integration, edit, approval, and publish action
PII protection
- Automatic redaction of PII (emails, phone numbers, names) in session recordings
- Customers can define custom regex rules to obfuscate additional sensitive fields
- PII-protection feature blacks out confidential information before screenshots are taken
Data handling
- All data encrypted in transit (TLS 1.2) and at rest
- Data segregation — each account's data is separated by unique IDs, accessible only by that customer's team
- Data deletion on request, processed promptly
- US and EU data residency options available
LLM guardrails
- LLM Guardrails limit AI responses to approved content, preventing the model from surfacing information outside what has been explicitly sanctioned
Tailored implementation
- Brainfish works with your team to understand your specific regulatory environment and customise the deployment accordingly
Next steps
Contact hello@brainfi.sh or your Brainfish account team to discuss FERPA-specific requirements, contractual protections, or a Data Processing Agreement for your institution.