Executive Summary
Graider is designed from the ground up to support FERPA (Family Educational Rights and Privacy Act) compliance. Our platform automatically strips student identifiers from typed work before AI grading and encrypts all data in transit and at rest. Image submissions are not yet auto-de-identified.
Key FERPA Protections
- No student names in typed grading text sent to AI: Student identifiers are automatically stripped from typed work before it is sent for grading (image submissions are not yet auto-de-identified)
- Minimal student data stored: Graider keeps class rosters and submissions in encrypted, access-controlled storage — only what's needed to run grading and the student portal, deletable on request
- Encrypted infrastructure: All data encrypted in transit (TLS/HTTPS) and at rest
- Teacher review built in: AI grades are suggestions — you can review, adjust, and approve them from your dashboard before exporting or entering grades in another system; portal release of results to students is controlled by separate settings
- No AI training: OpenAI, Anthropic, and Google state that they do not train their models on API data under their standard API terms — see provider details below
- Data deletion on request: Educators can request full deletion of their data at any time
What is FERPA?
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. It applies to all schools that receive funding from the U.S. Department of Education. Key requirements include:
- Schools must have written consent before disclosing personally identifiable information (PII) from education records
- Parents and eligible students have the right to access and request corrections to education records
- Schools must maintain reasonable security measures to protect education records
- Third-party service providers may access PII only under specific conditions (the "school official" exception)
How Graider Addresses FERPA Requirements
1. Minimizing Data Exposure
Graider's architecture is designed to minimize the exposure of student personally identifiable information (PII). This applies to all supported AI providers (OpenAI, Anthropic Claude, Google Gemini):
| Data Type |
On Graider Servers |
Sent to AI Provider |
| Student Names |
Yes — kept in encrypted rosters, never sent in grading text |
No for typed work — automatically stripped (images not yet auto-de-identified) |
| Student Work Content |
During grading; portal submissions retained until deleted |
Yes — typed work de-identified; image submissions not yet auto-de-identified |
| Grades & Scores |
Yes (encrypted, per educator) |
Only as de-identified score history when history-aware grading is used |
| Feedback Comments |
Yes (encrypted, per educator) |
Generated by AI, stored encrypted |
| Rubrics & Settings |
Yes (encrypted, per educator) |
Yes - Sent with grading request |
2. Student Name Stripping
Before typed content is sent to AI providers for grading, Graider automatically:
- Removes student names from file content
- Replaces names with generic placeholders (e.g., "Student")
- Strips identifying metadata from documents
- Processes filenames to remove student identifiers
- Image submissions (photos/scans) are not yet auto-de-identified
This de-identification is automatic for typed work. Photos and scans of student work are not yet auto-de-identified, so where practical, avoid uploading images that show student names.
3. Privacy-First Cloud Architecture
Graider is a cloud-based web application built with privacy as a foundational design principle:
- Minimal PII stored: class rosters and submissions live in encrypted, access-controlled storage; names are stripped from the text we send to AI providers, not from your roster
- Encrypted infrastructure: All data is encrypted in transit (TLS/HTTPS) and at rest on our servers
- Data isolation: Each educator's data is logically separated from other users
- Authenticated access: Only authorized educators can access their own data through secure account authentication
- Secure hosting: Our infrastructure runs on Railway, a SOC 2 compliant cloud platform
4. Data Flow Transparency
Here's exactly what happens when you grade an assignment with Graider:
- You upload assignment files through your web browser over an encrypted connection
- Graider's server reads and parses the files
- Student names and identifiers are automatically stripped from typed content (image uploads are sent for analysis as-is — see below)
- De-identified content + your rubric are sent to your chosen AI provider (OpenAI, Anthropic, or Google) over encrypted connections
- The AI provider returns grades and feedback
- Graider stores results on encrypted servers, linked to your roster so results display with real names for you
- You can review AI-generated grades and approve, modify, or reject them from your dashboard before exporting or entering them in another system (student portal submissions may show results to students automatically unless teacher approval is enabled)
The "School Official" Exception
FERPA allows schools to disclose PII to "school officials" with "legitimate educational interests" without consent. For third-party services, this typically requires:
- A written agreement specifying permitted uses
- That the service is under direct control of the school
- That data is used only for specified purposes
- Appropriate security measures
Important Consideration
While Graider strips student names from typed work before sending it to AI providers, the de-identified work itself — and any uploaded images, which are not yet auto-de-identified — is sent for AI analysis. Depending on your institution's interpretation, you may need to consider whether using AI grading tools falls under the school official exception or requires separate consent. We recommend consulting with your institution's FERPA compliance officer. Graider is available to execute a Data Processing Agreement (DPA) with your institution upon request.
AI Provider Data Handling
Graider supports multiple AI providers. Here's how each handles API data:
OpenAI (GPT-4o)
- Training: API data is NOT used to train models by default
- Retention: Inputs/outputs retained for 30 days for abuse monitoring, then deleted
- Typed work de-identified: Graider strips student names from typed work before sending; photos of handwritten work are not de-identified
- Policies: Privacy Policy | API Data Usage
Anthropic (Claude)
- Training: API data is NOT used to train models
- Retention: Inputs/outputs may be retained for up to 30 days for trust & safety
- Typed work de-identified: Graider strips student names from typed work before sending; roster-screenshot import sends the uploaded image (which shows names) for extraction
- Policies: Privacy Policy | Commercial Terms
Google (Gemini)
- Training: Paid API data is NOT used to train models
- Retention: Data handling varies by product tier; API data is not retained for training
- Typed work de-identified: Graider strips student names from typed work before sending; image submissions are not yet auto-de-identified
- Policies: Privacy Policy | Gemini API Terms
Mathpix (handwriting & math OCR)
- What it receives: Photos of handwritten student work, sent for transcription when handwriting recognition is used; images are not de-identified before OCR
- Policies: Privacy Policy
Consistent Protection Across All Providers
Regardless of which AI model you choose in Graider, the same protections apply: when grading typed work, student names and detectable identifiers are removed on a best-effort basis before content is sent, and all data is encrypted in transit and at rest. This text de-identification is heuristic and is not applied to uploaded images, so teachers should avoid submitting documents that display student names where practical.
Educator Responsibilities
As the educator using Graider, you retain responsibility for:
Your FERPA Compliance Checklist
- Reviewing and approving all AI-generated grades and feedback before sharing with students
- Ensuring your use of Graider complies with your institution's technology and privacy policies
- Consulting with your administration or FERPA compliance officer if required
- Maintaining the security of your Graider account credentials
- Not sharing your account or grading results with unauthorized individuals
- Requesting deletion of grading data when no longer needed
Comparison: Graider vs. Other AI Grading Tools
| Feature |
Graider |
Typical AI Grading Tools |
| Student names sent to AI |
No for typed work (automatically stripped); images not yet covered |
Often yes |
| Student PII stored |
Minimal — encrypted rosters and submissions, deletable on request |
Yes, often more broadly |
| Data encrypted |
Yes — in transit and at rest |
Varies by vendor |
| Teacher review |
Built into the dashboard — AI grades are suggestions you approve before export |
Often auto-published |
| AI trains on your data |
No by default — OpenAI, Anthropic, and Google state they do not train on API data by default; Google free-tier and Mathpix policies differ — see provider details |
Varies by vendor |
| DPA available |
Yes — available on request |
Varies by vendor |
| Data deletion |
On request — email admin@graider.live |
Depends on vendor policy |
Best Practices for Educators
Before Using Graider
- Review your school's acceptable use and technology policies
- Consult with your FERPA compliance officer if you have questions
- Understand what data is sent to AI providers and their retention policies
- Consider whether your institution requires parental notification for AI tool usage
- Request a Data Processing Agreement (DPA) if required by your institution
While Using Graider
- Always review AI-generated grades and feedback before distribution
- Keep your account credentials secure — do not share your login
- Log out of Graider on shared or public computers
- Instruct students not to include their names in the body of their work
Data Retention
- Graider stores your rubrics, assignment configurations, and grading results on encrypted servers
- Contact us to request deletion of your data at any time
- Follow your institution's record retention policies for grade records
- Consider periodic cleanup of old assignment configurations and results through your account settings
For IT Administrators
If you're evaluating Graider for your school or district:
- Architecture: Cloud web application hosted on Railway (SOC 2 compliant infrastructure)
- Data Flow: Browser → Graider servers (HTTPS) → AI providers (HTTPS). Student names stripped from typed work before AI transmission; image uploads (e.g., handwriting photos) go to OCR/vision services as-is.
- Authentication: Secure account-based authentication per educator
- PII Handling: Student names automatically stripped from typed work before AI processing; rosters and submissions stored encrypted, deletable on request
- Data Encryption: TLS/HTTPS in transit, encryption at rest
- Data Residency: Hosted in the United States
- DPA: Data Processing Agreement available upon request
- SSO: Clever and ClassLink SSO plus LTI 1.3 available for district deployments (roster sync included)
Frequently Asked Questions
Does Graider sign a Data Processing Agreement (DPA)?
Yes. Graider is available to execute a Data Processing Agreement with your institution. Contact us at admin@graider.live to request a DPA. When grading typed work, Graider removes student names and detectable identifiers from the text on a best-effort basis before content is sent to AI providers; this de-identification is heuristic and is not applied to uploaded images.
Can Graider be used with students under 13 (COPPA)?
Students can submit work through Graider's student portal using a class join code or a school-managed login (Clever/ClassLink SSO or email + code); they cannot self-register. Graider collects only school-directed student data and relies on the school-consent model under COPPA — consult your compliance officer for classes with students under 13.
What if a student's name appears in their essay content?
Graider strips names from metadata, file structure, and — for students on your roster — from the body of typed work itself, on a best-effort basis. Unusual spellings or nicknames can slip through, so we still recommend instructing students not to include their names in their work.
Is the AI grading accurate enough for official grades?
Graider is a tool to assist educators, not replace their judgment. You should always review AI-generated grades and feedback before making them official. The final grading decision is yours.
Contact Us
If you have questions about FERPA compliance or need additional information for your institution's review, please contact us:
admin@graider.live
We're happy to provide additional documentation or clarification for your compliance needs.
← Back to homepage