EdTech Data Safety & Evidence Labels

EdTech Data Safety & Evidence Label

Select a vendor

Choose a product to review its weighted screening signal.

Vendor representative? Select your product in the list to request access.

-- safety

--% evidence

-- confidence

Waiting for selectionReview evidence

The score combines five weighted screening factors.

District review format

Data Safety Facts

Product profile

Deployment contextDedham district use

Data sensitivity--

Select a vendor to see provisional data categories.

District standing--

Privacy agreementVerify record

Security maturity--

Evidence coverage--

Rating confidence--

Unknown controls lower confidence, not maturity.

Framework assurance--

Compliance-- Vendor transparency-- Incident historyDistrict input

Review the current DPA, product scope, evidence dates, and actual district configuration before approval.

Weighted screening model

Vendor risk matrix

The five weighted risk inputs produce a raw safety score. A neutral product starts at 50. Net gains above the old 53-point neutral score are doubled; net shortfalls below it retain their previous point-for-point effect.

Composite vendor safety -- / 100

Unknown security controls are neutral and reduce confidence rather than the Safety Score. Verified negative findings create penalties.

Data Sensitivity rating

Show how harmful the exposed data could be.

Six components measure intrinsic sensitivity and controllable exposure. This is already a risk score, so its contribution is Data Sensitivity Score x 30%. Sensitive-purpose products are not treated as careless when they minimize and tightly manage exposure.

-- data sensitivity -- risk points

High-sensitivity data detectedInventory not reviewed

Intrinsic data sensitivity--Not assessed

Exposure management--Not assessed

Intrinsic sensitivity describes the data itself; exposure management describes how narrowly it is collected, retained, identified, and shared.

Data componentShareRiskWeighted

-- / 100 sensitivity risk -- x 30% = -- risk points

0-19Minimal 20-39Low 40-59Moderate 60-79High 80-100Critical

Unknown inventory fields are shown as unknown and receive a conservative provisional risk value.

Data inventory input

Document the actual district deployment.

Scope and evidence required

Select every category collected or generated, then document identifiability, deployment size, retention, and downstream sharing. Unreviewed vendor input cannot lower the public-evidence baseline.

Data categories collected or generated

Identifiability and linkability Population / deployment Retention and deletion Sharing and subprocessors Approx. students exposed Subprocessors receiving data Historical years retained Inventory or contract source Evidence date Covered product scope Data-flow, deletion, or exception notes

Staff data is also involved Student data or prompts reach an AI provider Data is used for advertising or cross-context analytics

District reviewer confirmed the categories, population, retention, sharing, source, and product scope

Security Maturity rating

Measure security capability, not just stated compliance.

Seven security domains measure underlying maturity separately from evidence coverage. The risk model converts the positive score using (100 - Security Maturity Score) x 25%. UpGuard supplies external observable evidence for one 10% security subdomain; it does not replace verified internal controls.

-- security maturity -- risk points

Evidence Coverage--%

No security evidence has been assessed.

Security domainEvidence stateMaturity

-- / 100 maturity (100 - --) x 25% = -- risk points

0-39High concern 40-59Weak 60-74Developing 75-89Strong 90-100Advanced

Unknown controls use a neutral maturity baseline and reduce evidence coverage. Only verified negative evidence creates a penalty.

Vendor evidence input

Record maturity and evidence separately.

District-controlled review

Choose one domain, describe the implemented control, and identify the strongest evidence reviewed. Unknown evidence remains neutral. Vendor-reported positives receive partial recognition, while verified negatives create penalties.

Security domain Control maturity Evidence confidence Evidence date Source document Product scope Control details or exceptions

District reviewer confirmed the source, date, product scope, and evidence status

Vendor progression ladder

A realistic public-evidence roadmap.

Year 1 · Basic transparency

Security and privacy pages, security.txt, contacts, retention and deletion policy, subprocessors, AI-use statement, breach commitment, and a standard DPA.

Year 2 · Structured evidence

Trust center, MFA and encryption summaries, vulnerability disclosure, penetration-test summary, continuity, secure-development, and incident-response overviews.

Year 3 · Independent assurance

SOC 2 or ISO where feasible, current penetration testing, formal risk management, third-party posture signals, and auditable deletion controls.

SOC 2 and ISO raise confidence but are not the only route to a strong rating. Technical documentation, verified controls, credible attestations, and observable evidence can also support maturity.

Authoritative starting points

Security source library

NIST CSF 2.0Governance and cybersecurity risk outcomes NIST SSDFSecure software development practices CIS ControlsPrioritized and measurable security safeguards CSA STARPublic cloud security assurance registry

Compliance rating

Score the quality, scope, and currency of K-12 evidence.

Compliance measures known contract and control quality. Unverified items remain neutral; reviewed positive or negative evidence changes the score. The risk model converts it using (100 - Compliance Score) x 20%.

-- compliance score -- risk points

RatingNot assessed

DPANot verified

FERPA / COPPANot verified

SOC 2Not publicly verified

ISO 27001Not publicly verified

Data deletionNot verified

Breach noticeNot verified

Agreement renewalNot entered

Compliance componentShareEvidence qualityEarned

-- / 100 compliance (100 - --) x 20% = -- risk points

0-24Critical 25-49Weak 50-74Moderate 75-89Good 90-100Strong

Public references are starting evidence, not proof that the district's product and contract are in scope.

Evidence input

Assess the current compliance file.

District verification

Rate each component by the strongest document actually reviewed. Include links, dates, and exceptions so the score can be reproduced later.

DPA or agreement link Assurance evidence link Agreement renewal Breach-notification hours Scope, exceptions, or review notes

District reviewer confirmed the evidence, dates, and product scope

Authoritative starting points

Compliance source library

SDPC RegistryExecuted student privacy agreements and state alliances Dedham agreementsDistrict student-data privacy records FERPA guidanceWritten agreements and direct-control provisions COPPA guidanceCurrent FTC requirements, including schools

Incident History rating

Document events, context, and response quality.

Incident risk uses verified events, not rumors. UpGuard changes may create a review lead, but authoritative notices and corroborated records determine this score. Each event is scored for severity, scope, affected data, root cause, response, regulatory action, repeat history, and recency before contributing 10% of composite vendor risk.

50 incident risk 5.0 weighted points

StatusNot yet assessed

Verified events0

Vendor student data affectedUnknown

Regulatory notice or actionNone documented

Remediation verifiedNot reviewed

Last checkedNot reviewed

Calculation backup

How incident risk is calculated

0 of 5 source groups reviewed

Severity0-20

Scope0-15

Data sensitivity0-20

Root cause0-10

Response quality0-15

Regulatory action0-10

Repeat history0-10

Recency55%-100%

Highest recency-adjusted verified event + 7 points for each additional event No verified calculation

0-10No verified material incidents found 11-30Minor or old, well remediated 31-50Meaningful incident 51-70Recent serious or multiple 71-100Repeated, systemic, or enforced

No incident records have been added for this vendor.

Official starting points

Incident source library

What supports this label

Evidence register

Select a vendor to inspect evidence and gaps.

Make vendor risk legible at a glance.

Claim your vendor profile

Select a vendor

Data Safety Facts

Vendor risk matrix

Show how harmful the exposed data could be.

Document the actual district deployment.

Measure security capability, not just stated compliance.

Record maturity and evidence separately.

A realistic public-evidence roadmap.

Security source library

Score the quality, scope, and currency of K-12 evidence.

Assess the current compliance file.

Compliance source library

See the evidence behind the score.

Provide evidence to improve the model.

Document events, context, and response quality.

How incident risk is calculated

Record where the district checked.

Add a documented event.

Incident source library

Evidence register

Safety, evidence, and confidence are separate.

Data Sensitivity

Security Maturity

Compliance

Vendor Transparency

Incident History

Claim this vendor profile