Skip to main content
This page should not be considered as legal guidance. Consult with your legal advisor to understand how FERPA impacts your school or organization. Fillout is engineered to keep your data secure and private. If you work at a school, district, college, or university, you can use Fillout forms and Zite apps to collect and manage student data while meeting your FERPA obligations.

​
What is FERPA?

The Family Educational Rights and Privacy Act, or FERPA, is a United States federal law that protects the privacy of student education records. It applies to schools and educational institutions that receive funding from the U.S. Department of Education. In short, FERPA gives parents the right to review and request corrections to their child’s education records, and requires schools to get written consent before sharing personally identifiable information from those records, with some exceptions. These rights transfer to the student when they turn 18 or attend a school beyond the high school level.

​
Does Fillout support FERPA?

Yes, you can use Fillout and Zite in a way that supports FERPA. FERPA places its obligations on schools rather than on software vendors, so there is no official FERPA certification for a tool like Fillout. What matters is how your data is handled, and who is responsible for it.
  • Fillout acts as the data processor. We process student data only on your behalf, to provide our services to you.
  • Your school is in control. You decide what information your forms and apps collect, who can access it, where it’s sent, and when it’s deleted.
Because your school stays responsible for its education records, check with your administration or legal advisor that your use of Fillout and Zite fits your school’s FERPA policies before collecting student data.

​
How we protect student data

Fillout and Zite follow industry best practices to keep the data you collect secure.
  • SOC 2 Type 2 - we are SOC 2 Type 2 compliant, which verifies that we meet rigorous standards for security, availability, and confidentiality.
  • Encryption - all data is encrypted in transit (TLS 1.2+) between you, your respondents, and our servers, and encrypted at rest (AES-256).
  • US hosting - by default, your data is stored and processed in the United States.
  • Subprocessors - we only work with a limited list of third-party services to provide our product. See the full list of subprocessors and what each one is used for.
  • Access controls - our employees only have access to infrastructure on an as-needed basis, through dedicated user accounts protected by two-factor authentication.
For more information, check our security docs.

​
Using Fillout forms with student data

A few Fillout features are especially useful when your forms collect student information.
  • Encrypted forms - every form response is encrypted in transit and at rest.
  • Granular permissions - limit which team members can edit forms or view results in each workspace, so only the right staff can see student submissions. Available on the Team plan and above.
When building your form, only ask for the student information you actually need, and delete responses you no longer need from both Fillout and any app you’ve synced them to.

​
Using Zite apps with student data

If you build apps with Zite, such as a student portal or an internal tool for staff, you control who can open each app and what they can do in it.
  • App access controls - keep an app internal to members of your organization, or share it to the web and require users to log in. Use user groups and roles to manage what each person can access.
  • SSO for your app - require users to sign in through your school’s identity provider, like Okta, Azure AD, or Google Workspace, before they can access the app. Available on the Enterprise plan.
  • Audit logs - review who did what and when across your organization, including logins and changes to users and permissions. Available on the Enterprise plan.

​
Requesting a DPA

Many schools need a Data Processing Agreement (DPA) in place with any vendor that handles student data. Our standard DPA is available to any customer at main.fillout.com/dpa. If you have additional questions about security or privacy, contact security@fillout.com.

Security at Zite

Safeguards including SOC 2 Type 2 compliance.

Subprocessors

What we use for data processing and integrations.

Fillout and GDPR-Compliant Forms

Form privacy and how your data is processed and protected.