Helper Helper takes student data privacy and security seriously. Our platform is built on enterprise-grade infrastructure with multiple layers of protection, and we are fully compliant with federal regulations including FERPA and COPPA as well as applicable state student privacy laws. Whether your state has adopted its own student data privacy statute or follows federal guidelines, Helper Helper is built to meet or exceed those requirements so your district can adopt our platform with confidence.
“Student security and privacy are top priorities for us, and it’s clear they are for Helper Helper as well. SFTP transfers are secured and firewalled, and SSO support further reduces risk by eliminating the need for separate credentials. Both were reassuring during the vetting process.”
Compliance & Assessments
Higher Education Community Vendor Assessment Toolkit (HECVAT)
Helper Helper has completed the HECVAT assessment, the industry-standard security review used by higher education institutions and school districts to evaluate cloud-hosted vendor services. The HECVAT was developed by the higher education community (EDUCAUSE) and is widely used by colleges and universities to assess the IT security, data protection, and privacy practices of third-party software vendors before adoption. While originally designed for higher ed, its comprehensive framework is equally valuable for K-12 schools and districts looking for a rigorous, standardized way to evaluate whether a vendor meets their security and compliance requirements. Request our completed HECVAT below.
Family Educational Rights and Privacy Act (FERPA)
Helper Helper is fully compliant with FERPA requirements and operates as a "school official" under 34 CFR § 99.31(a)(1)(i)(B). This designation benefits both parties: for your school or district, it means you can deploy Helper Helper without the administrative burden of collecting individual parent consent for every student — the same way you onboard other essential technology platforms. For Helper Helper, it means we are held to the same strict data-handling standards as your own employees, giving your community confidence that student records are protected by the full weight of federal privacy law.
What does "school official" mean under FERPA?
FERPA generally requires schools to obtain written parent consent before disclosing personally identifiable information (PII) from student education records. However, the law provides an exception: schools may share education records with outside service providers designated as "school officials" who have a "legitimate educational interest" in the data — without obtaining individual parent consent for each disclosure.
When a school or district contracts with Helper Helper, we are designated as a school official because we perform an institutional service — managing volunteer hours, service learning records, and related reporting — that the school would otherwise handle with its own employees.
What this requires of Helper Helper:
- Purpose limitation — We use student education records only for the purposes specified by the school or district. Volunteer and service learning data is processed solely to deliver the services your institution has contracted for.
- Direct control — We operate under the direct control of the school with respect to the use and maintenance of education records, as governed by our contractual agreements.
- No unauthorized re-disclosure — We do not share, sell, or disclose student records to any unauthorized third parties. Data stays between Helper Helper and your institution.
- FERPA-equivalent protections — We apply the same safeguards to student data that FERPA requires of the school itself.
What this means for your school or district:
- No individual parent consent needed — Because Helper Helper operates as a school official, your institution does not need to collect signed consent forms from every parent before using our platform. The school official exception streamlines adoption.
- Your annual FERPA notification should include outside service providers — Schools are required to include their criteria for designating school officials and defining legitimate educational interests in the annual notification provided to parents. Most districts already include language covering technology vendors and contracted service providers.
- Your institution retains control — The school or district remains the owner of all student education records. Helper Helper processes this data on your behalf and at your direction. Upon contract termination, data is deleted or returned per your instructions.
Children's Online Privacy Protection Act (COPPA)
Helper Helper only allows children under the age of 13 to use the Service when a school or school district acts as the parents' agent and provides consent under COPPA on behalf of parents. Children's information is used only in a school-authorized educational context and for no other commercial purpose.
The FTC provides guidance confirming that schools may consent on behalf of parents in the educational context under COPPA. Please see our Notice of Data Practices for Children Under 13 (available below) and our Privacy Policy for further details.
Infrastructure & Encryption
- Hosting: Amazon Web Services (AWS) in US-East-1
- Storage: AWS S3 and RDS for storage with automated backups
- Encryption: All data is encrypted at-rest and in-transit
Access Controls & Data Handling
- Role-based access controls (RBAC) for administrators, coordinators, and students
- Optional Single Sign-On (SSO) integration for institutional multi-factor authentication
- Data retained only as long as needed for the service
- Data export or deletion available upon request
- No sale or sharing of student data with any third parties
Third-Party Service Providers
The following third-party service providers may have incidental access to communications between Helper Helper and users of the Helper Helper platform, both for automated messages and those initiated by your admins. They offer their own security guarantees and compliance certifications linked below.
Request Documents
Select the security, privacy, and accessibility documents you'd like to download and a member of our team will reach out with them shortly.