Where your data is stored and who can see it

Where it lives

AI requests use Google Cloud Vertex AI through U.S. endpoints. See our privacy policy for provider data use and retention details.

PrepIEP runs on Google Firebase in the United States. Your IEP PDFs are stored in Cloud Storage; your account, Advisor exchanges, and goals are stored in Firestore. Everything is encrypted at rest (AES-256) and in transit (TLS 1.2+). Firebase carries SOC 2 Type II and ISO 27001 certifications.

Who can see it

You can see your data through the app. Nobody at your school district can see your data through PrepIEP. The subprocessors listed on our subprocessor page process data to provide the service. We do not sell data.

Authorized operators may access limited records for support, security investigations, and error, safety and service-quality review, as described in Privacy Policy §§3 and 10. This limited review may help improve prompt instructions and safety behavior; it is separate from model training.

Our FERPA stance

PrepIEP is a parent-facing tool. We act as a processor on your instructions; we are not a "school official" under FERPA and we have no direct relationship with any LEA without a signed Data Processing Agreement. Districts cannot pull your records from PrepIEP — only you can download supported artifacts or request a complete export.

What we don't do

We don't sell your data.
We don't use your documents to train any AI model.
We don't share with marketing partners.
We don't use session replay on screens that show your child's records (per our Privacy Policy).

The 90-day AI defensive record

For 90 days after each AI exchange, we retain a defensive record: your user identifier, the prompt template version, the input, and the output. This exists so we can audit advisor mistakes and respond if a parent disputes what the AI said. Records expire after at most 90 days through automatic expiry and scheduled cleanup. Account deletion also removes attributable active AI records. Detail in Privacy Policy §10.

For full mechanics: Privacy Policy, Subprocessors, Terms. Questions: contact@prepiep.com.