What FERPA-compliant AI should actually mean in higher education

The school official exception is the core operating model most colleges rely on when a vendor handles education records without individual student consent. The Department's guidance says the outside party must perform an institutional function, be under the institution's direct control, and only use the information for the authorized purpose.

That means a FERPA posture is never just a marketing badge. It is a combination of product scope, procurement terms, operational restrictions, and ongoing institutional governance.

In practice, schools should expect more than a general assurance. They should expect concrete controls around access, retention, deletion, logging, and how the AI system behaves with sensitive data.

NIST's AI Risk Management Framework is useful here even though it is not FERPA-specific. It reinforces the need for governance, measurement, and risk management throughout the AI lifecycle rather than only at procurement time.

Your current public site already substantiates the core posture: Edvise states that it acts as a school official under FERPA, keeps student data under institutional control, uses encryption in transit and at rest, supports role-based access, maintains audit logging, and can support institution-specific retention and deletion workflows.

The site also makes stronger operational points that matter for AI: scoped knowledge sources, human oversight, exportable audit trails, configurable retention, optional customer-managed keys, and DLP handling for sensitive strings in Pulse workflows. That is the right type of public evidence to publish because it describes controls, not just outcomes.