Where your data is stored and who can see it
Where it lives
PrepIEP runs on Google Firebase in the United States. Your IEP PDFs are stored in Cloud Storage; your account, Advisor exchanges, and goals are stored in Firestore. Everything is encrypted at rest (AES-256) and in transit (TLS 1.2+). Firebase carries SOC 2 Type II and ISO 27001 certifications.
Who can see it
You can see your data through the app. Nobody at your school district can see your data through PrepIEP. We don't share parent-uploaded documents with anyone, and we don't sell data.
A small, audited group of operators (currently: the founder) can access your account when responding to a support request you've initiated — and only then. Access is logged. Beyond that, no human at PrepIEP routinely reads your IEP documents.
Our FERPA stance
PrepIEP is a parent-facing tool. We act as a processor on your instructions; we are not a "school official" under FERPA and we have no direct relationship with any LEA without a signed Data Processing Agreement. Districts cannot pull your records from PrepIEP — only you can export them.
What we don't do
- We don't sell your data.
- We don't use your documents to train any AI model.
- We don't share with marketing partners.
- We don't use session replay on screens that show your child's records (per our Privacy Policy).
The 90-day AI defensive record
For 90 days after each AI exchange, we retain a defensive record: your user identifier, the prompt template version, the input, and the output. This exists so we can audit advisor mistakes and respond if a parent disputes what the AI said. After 90 days the record is automatically deleted. Detail in Privacy Policy §10.
For full mechanics: Privacy Policy, Subprocessors, Terms. Questions: contact@prepiep.com.