A practical ed-tech vendor checklist for school leaders, including student data, contracts, access, retention, and when privacy rules apply.
A faith-based school should review an ed-tech vendor before giving it student information. Identify what data the tool needs, what the vendor does with it, who can access it, when it is deleted, and how an incident will be reported. Then confirm which privacy laws actually apply to the school and the service; “FERPA compliant” on a sales page is not enough.
Why does applicability matter for Christian schools?
Not every school has identical obligations. The U.S. Department of Education says FERPA applies to educational institutions receiving funds from programs it administers. Private and parochial elementary and secondary schools generally do not receive those funds and generally are not subject to FERPA. A school's exact funding and structure matter, so confirm its position with qualified counsel rather than assuming it is covered or exempt.
CIPA is tied to certain E-Rate support for schools and libraries; it is not a universal requirement for every church or school. COPPA regulates covered online service operators' collection of personal information from children under 13, and school consent on behalf of parents is limited to educational use. State laws, vendor contracts, accreditation requirements, and parent commitments may impose other obligations. This guide is an operational checklist, not legal advice.
What should the school ask before using a new app?
- Purpose: What classroom or administrative problem does the tool solve? Is student-level data necessary for that purpose?
- Data inventory: Which names, identifiers, work samples, grades, communications, or device details will be collected?
- Use and sharing: Is information used only to provide the service? Are ads, profiling, training, or onward sharing involved?
- Access: Which vendor employees or subcontractors can view the information, and how is privileged access approved and logged?
- Retention: What happens to data when an account, school year, or contract ends? Can the school request deletion and receive confirmation?
- Incidents: When and how will the vendor notify the school, what support will it provide, and who pays for recovery or required notices?
- Exit: Can the school export its data in a usable format without an unexpected fee?
Require a written answer for anything important. A salesperson's email is less useful than a signed agreement or published product terms that the school can retain. The Department of Education's vendor FAQ explains that, where the FERPA school-official exception is used, the provider must be under the school or district's direct control with respect to education-record information.
How can a small school keep reviews manageable?
Create a short intake form and use it for every new tool. Route tools that touch identifiable student information to an administrator and privacy lead. A low-risk tool that processes only public lesson material may need a lighter review than a platform holding student records. Keep a register of approved tools, vendor contacts, contracts, data categories, and renewal dates.
Review what happens outside the main contract. A teacher may sign up for a free classroom app on a personal email address; a volunteer may upload a roster to a shared folder. Provide an approved route so staff can get useful technology without bypassing the school's review. If the school adopts AI tools, the same intake should ask whether student prompts or output are retained or used for model improvement. Our AI policy guide covers classroom rules.
What should the MSP be responsible for?
An IT provider can help inventory integrations, configure single sign-on, restrict access, preserve logs, and manage offboarding. School leadership should decide which vendors are permitted and what educational purpose justifies the data use. Write down who reviews contracts and who disables an unsafe integration. If Faith IT by World Synergy manages part of your school's technology, ask for those roles to be documented in the service agreement.
Common questions
Does FERPA apply to every Christian school?
No. FERPA generally applies to institutions receiving funds under a program administered by the U.S. Department of Education; most private and parochial elementary and secondary schools do not receive those funds directly. Verify your school's particular funding and other legal duties with counsel.
Can a school consent for parents under COPPA?
In the educational setting, a school may be able to consent for the collection of information from children under 13 when the service is used for the school's benefit and no other commercial purpose. The vendor must give the school the information needed to make that decision. Review the actual product and contract before relying on school consent.
Is a “secure” badge enough to approve a vendor?
No. Ask what the badge covers, when it was issued, and whether it applies to the product and data you will use. You still need to review access, permitted use, retention, deletion, incident notification, and exit rights.
For help mapping apps and access controls, talk with Faith IT about managed school IT.
Sources and further reading