Compliance

Overview

Celerity is built for education data workflows. The controls described here support a customer's privacy program; they are not a blanket legal certification. Applicability depends on the deployment, data, institution policies, and executed agreements.

Federal Privacy Responsibilities

FERPA

A district may designate a service provider as a school official only when its facts, policies, and agreement satisfy FERPA. The customer and Celerity document the authorized purpose, access, retention, and deletion terms during onboarding.

• Direct control by the contracting district over the purpose and scope of data access
• Prohibition on re-disclosure of personally identifiable information from education records
• Data use limited exclusively to the contracted service
• Deletion of all education records upon contract termination

COPPA

The pilot is intended for institution-managed use, not direct consumer enrollment by children. The institution determines whether COPPA applies and documents the appropriate consent and data-minimization requirements before student data is introduced.

State Privacy Laws

State obligations vary and are evaluated with the customer before a deployment processes student data. Celerity does not publish a blanket state-law certification.

Additional states will be added as Celerity enters new markets. Contact us if your state has specific requirements.

Student Data Privacy Consortium (SDPC)

Customer-specific data processing terms are reviewed privately during onboarding. Celerity does not publish DPA terms or imply that one agreement resolves every institution's requirements.

Data Flow

Student data flows through the Celerity platform as follows:

District SIS / Data Source
        |
        v
  Keycloak (Authentication)
  OIDC / SAML 2.0 — identity verified
        |
        v
  PostgREST API (Authorization)
  JWT validated — tenant scope enforced
        |
        v
  Tenant Schema (Isolation)
  Schema-per-tenant + row-level security
        |
        v
  Amazon RDS (Storage)
  AES-256 at rest — TLS 1.2+ in transit
  US-only data residency

Each tenant's data is isolated at the database schema level. Cross-tenant access is architecturally prevented by row-level security policies enforced at every query.

Data Classification

Data Retention & Deletion

• Retention and deletion schedules are defined in the applicable customer agreement
• Data export and deletion procedures are confirmed during onboarding
• Backup retention is included in the customer-specific deletion procedure
• Completion evidence is provided when required by the applicable agreement

Prohibited Uses

Celerity will never:

• Sell student data or use it for targeted advertising
• Use student data to build profiles for non-educational purposes
• Train machine learning or AI models on student data
• Share data with third parties except as required to operate the service (see sub-processor list in DPA)

Parent & Guardian Rights

Under FERPA, parents and eligible students have the right to inspect and review education records. Celerity supports this process:

• Districts submit data export requests through the Celerity portal or via their account representative
• Celerity provides the requested data export in a timely manner
• Requests for amendment or correction are handled by the contracting district, with Celerity providing technical support as needed

Documents

The following compliance documents are available. Per-customer agreements (DPA, MSA) are provided during onboarding and are accessible through the customer portal.

Contact

Compliance inquiries: privacy@celerityedu.com

Security inquiries: security@celerityedu.com