School approval pack for an IEP tracking app
How to get an IEP tracking app approved by your school or district. You are not allowed to install it, and the person who decides has forty other requests. This is what they need, in the order they usually ask for it, with the awkward answers included rather than left out.
This is information, not a certification. Nothing here approves anything. Whether this product may be used with student records in your setting is a decision for your district, under its own agreements and review process. A vendor page saying “FERPA compliant” does not transfer any obligation away from your school, and that phrase does not describe a status a product can hold on its own.
Start here: is this even the right question?
Two different things get mixed together, and separating them saves a fortnight.
- Using it with fictional data
- Trialling the app or the free tools on invented practice data usually needs nobody’s permission, because no student record is involved. This is how to find out whether it is worth asking about at all.
- Using it with real student data
- A different question entirely, and the one this pack is for. It needs your district’s process, and generally an agreement between the district and the vendor.
Owning the iPhone does not settle it. A personal device holding student records is a question your district has a policy about, whoever bought the phone.
The answers, as they will be asked for
| What they ask | The answer |
|---|---|
| Who is the vendor? | An independent developer, not a company with a procurement department. That is a real consideration for a district and it is better raised early than discovered late. Details on the about page. |
| What personal data reaches your servers? | The student alias you choose, plus measurements, dates, goals and observations, and your own account email. Full name, class, grade, case manager and your private notes stay on the device. |
| Is the alias anonymous? | No, and we do not describe it that way. It is a pseudonym you pick. If you type a child’s real first name into it, that first name is on our servers. Use initials or a code. |
| Is audio recorded or uploaded? | No. Speech is transcribed on the device where iOS supports it, audio is never written to disk, and what leaves the device is the number you confirmed. On older hardware iOS may fall back to Apple’s speech service, which is Apple’s processing rather than ours. |
| Is student data sent to an AI provider? | No. Draft narratives are produced by deterministic code on our own server. No language model is involved and nothing is sent to any third-party AI service. |
| Encryption? | AES-GCM at rest on the device under a device-only Keychain key, TLS in transit with insecure connections disabled in the app. |
| Deletion and export? | A student, all student data, or the whole account can be deleted from inside the app, and account deletion removes the records rather than just the login. Export of your own data is not paywalled. |
| SOC 2? HIPAA? A FERPA certificate? | None of those, and the third is not a thing that exists. Stated plainly on the security page rather than buried. |
| Accessibility? | VoiceOver, Dynamic Type and keyboard support, targeting WCAG 2.2 AA. That is a target being worked to, not a conformance claim, and no VPAT has been published. |
| Can we sign an agreement? | We will read and respond to your district’s data processing agreement. District admin controls, single sign-on and audit logs are planned, not shipping; the roadmap is current. Start at contact or email [email protected]. |
The email to send
Approvers say yes faster to a request that already contains the answers. Edit freely; the point is the shape.
Subject: Request to evaluate an IEP data collection app — [your name], [your building]
Hello [name],
I would like to evaluate IEP VoiceTracker for collecting progress monitoring data on my caseload, and I want to go through the approval process properly before any real student information is involved.
Two things I can do without a decision from you: run it on invented practice data, and use the free browser tools on their website, which do not involve an account. I am asking about the step after that.
Summary of what I have been able to establish: measurements, dates, goals and a student alias I choose reach their server; full name, class, grade and my own notes stay on the device; audio is transcribed on the device and is not uploaded; no student data goes to any AI provider; data is encrypted at rest on the device and in transit; I can delete a student or the whole account from inside the app. They hold no SOC 2 or HIPAA attestation and make no FERPA certification claim. Their security page is at ieptracker.app/security.html and their privacy policy at ieptracker.app/privacy.html.
What I need from you: whether this fits our current process, whether a data processing agreement would be required before I use it with student data, and what the timeline for that looks like. Their contact for agreements is [email protected].
If the answer is no, that is a useful answer and I will stay on our current method. Thank you.
[your name]
Questions to ask us, and anyone else
These are the ones worth asking of every vendor in this category, including this one. A vendor who dodges them is telling you something.
- Exactly which fields reach your servers, and which stay on the device?
- Is the identifier you hold a pseudonym or a real name, and what happens if a teacher types a real name into it?
- Which subprocessors touch student data, and where are they?
- Is any student data used to train a model, by you or by anyone you send it to?
- What is the retention period after deletion, including backups?
- Can a teacher export everything they entered, in a format that is usable elsewhere, without paying?
- What happens to the data if the product shuts down?
- Which accessibility claims are tested, and is there a VPAT?
- Will you sign our data processing agreement, or only your own?
Our answers to all nine are on the security page and in the privacy policy. If one is not there, email [email protected] and it will be added.
Reference
Definitions rather than opinions. Useful when a conversation gets stuck on what a term means.