Is Brisk Teaching FERPA Compliant?
Brisk Teaching cannot be "FERPA certified" by any government body, because FERPA (20 U.S.C. § 1232g) issues no certificate to software vendors; it regulates schools and districts directly. What Brisk actually offers a district is a specific bundle of contractual and technical evidence: a National Data Privacy Agreement built specifically around FERPA and related student-privacy statutes, a SOC 2 Type II security audit, and a browser-extension architecture that limits what it touches in the first place.
Quick Answer: Brisk Teaching is not, and cannot be, "FERPA compliant" in the way a pricing page implies, since no such government certification exists for any vendor. What Brisk has instead is a signed National Data Privacy Agreement (NDPA) executed in roughly two dozen states, built specifically around FERPA, COPPA, and state privacy statutes, plus a SOC 2 Type II report as of October 2025 covering the security controls behind it (Brisk Teaching, Privacy Center, 2025). Its trigger-based extension design, reading page content only when a teacher actively runs a tool, also narrows how much of a student's work ever becomes a record Brisk holds at all. None of that is a government seal; a district's own signed agreement still does the actual legal work.
That combination, contract plus independent security audit plus a data-minimizing architecture, is a more layered answer than most AI-in-education vendors offer, and it is worth understanding each piece separately rather than accepting "FERPA and COPPA compliant" as one settled fact. This guide walks through what FERPA actually requires, a legal wrinkle specific to how Brisk's extension handles (and discards) student text, what the National Data Privacy Agreement actually is, and where a genuine security audit fits into a FERPA review that it does not, on its own, resolve. For the full legal framework connecting FERPA and COPPA, see AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026); for the fuller data-handling picture, see Brisk Teaching and Student Data Privacy: What Teachers Should Know.
What FERPA Actually Asks of a Browser Extension Like Brisk
FERPA restricts when a school may disclose personally identifiable information from a student's education record to an outside party, and the restriction binds the school, not the extension running inside a teacher's browser. Brisk participates only through the "school official" exception at 34 CFR § 99.31(a)(1), the same mechanism every AI vendor in this category relies on, which requires a school to retain direct control, limit the vendor to an authorized purpose, and bar the vendor from redisclosing data without permission.
A Trigger-Based Tool Changes What "Direct Control" Has to Cover
Most classroom AI tools maintain a persistent account and a running history the moment a student logs in. Brisk works differently: according to its own published architecture, the extension accesses nothing at install, checks only page structure when its icon is clicked, and processes actual content only when a teacher selects a specific tool to run against it. That trigger-based design means the "direct control" a district needs to maintain applies to a series of discrete, teacher-initiated events rather than an always-on data pipeline.
That distinction matters for a technology office writing an internal policy. Reviewing Brisk's FERPA exposure is less about auditing a database of stored student profiles, the way it would be for a rostered platform, and more about confirming which specific tools a staff member is authorized to run against which specific documents.
Does Brisk Even "Maintain" an Education Record When It Discards the Source Text?
FERPA's own definition of an "education record" requires a record "maintained by" an educational agency or a party acting for it, and Brisk's published security documentation states it does not retain the underlying text of a student's work after a feedback task completes, only the request and the generated output. That raises a genuinely specific question most AI-vendor privacy pages never force: if the source material itself is not kept, is there still a record for FERPA to attach to at all?
The honest answer is a qualified yes, not a clean escape from the law. Even with the source essay discarded, two things typically persist: the generated output itself, such as a feedback summary tied to an assignment, and metadata showing the request occurred. Either can still be a record "maintained by" a school official if it is retained and tied to an identifiable student, which means Brisk's design shrinks the FERPA-relevant footprint without eliminating it.
| What Brisk retains after a task | Is it plausibly a FERPA "education record"? |
|---|---|
| The original student essay or document text | No, by design; Brisk's own documentation states this is not retained |
| The generated feedback or output | Likely yes, if tied to an identifiable student and kept by the school or its school official |
| A log that a request occurred | Possibly, depending on what identifying detail the log retains |
| Inspect Writing's edit-history replay | Yes; it is drawn from the student's own Google Docs history, a record in its own right |
A Grade 8 Scenario, Walked Through
Say you teach Grade 8 science and a parent, after hearing about Brisk from another family, emails your school asking exactly what the tool has on file about their child. A FERPA-literate answer is more precise than "not much."
- Confirm which specific Brisk tools were used on that student's work, since Targeted Feedback, Quiz Maker, and Inspect Writing each leave a different footprint behind.
- Distinguish the discarded source text from the retained output when you respond, rather than implying nothing at all is kept.
- Route the request through your school's normal FERPA inspection process, the same one that would handle a request about a report card or disciplinary file.
- Check whether Inspect Writing was ever run on that student's document, since its edit-history replay is a different, more persistent kind of record than a one-time feedback summary.
The National Data Privacy Agreement: Brisk's Actual FERPA-Specific Instrument
The National Data Privacy Agreement (NDPA) is not a generic contract; it is a standardized template built by the Student Data Privacy Consortium specifically to document a vendor's duties under FERPA, COPPA, and state privacy statutes, and Brisk has executed it in roughly two dozen states, including California, Illinois, Massachusetts, and Virginia. That is a materially different claim than a vendor writing "we comply with FERPA" on its own website.
An NDPA exhibit typically states that its terms govern over a vendor's general Terms of Service or Privacy Policy whenever the two conflict, the same supremacy clause structure found in Khan Academy's district-level agreements for Khanmigo, covered in Is Khanmigo FERPA Compliant?. That pattern is not a coincidence; both run through data-privacy agreement templates associated with the same Student Data Privacy Consortium infrastructure that many states now use as a shared baseline.
What the NDPA Covers, and What a District Still Has to Check
An executed NDPA is real, enforceable evidence. It is not automatically complete evidence for every classroom, and three questions are worth confirming before assuming it covers your specific rollout.
- Is your state actually on Brisk's executed list, not just a state where the NDPA framework generally exists?
- Does the exhibit your district would sign onto name Brisk Boost specifically, or only the teacher-facing feedback and grading tools that were likely the core product when the agreement was first negotiated?
- Has anyone at your school actually confirmed the exhibit is signed, rather than assuming a colleague or a previous administrator already handled it?
SOC 2 Type II: Real Certification, Different Question Than FERPA
Brisk Teaching's own privacy materials state it completed a SOC 2 Type II audit as of October 2025, an independent examination of security controls conducted by an outside auditor over a sustained period, not a single point-in-time check (Brisk Teaching, Privacy Center, 2025). It is worth being precise about what that actually proves, because it answers a different question than FERPA compliance does, even though the two get mentioned in the same breath on many vendor pages.
FERPA does not spell out prescriptive technical security controls the way a law like GLBA's Safeguards Rule does; instead, its school-official exception simply expects a school to maintain "direct control," which in practice includes reasonable data-security expectations that a signed DPA usually spells out explicitly. A SOC 2 Type II report is independent evidence that Brisk's access controls, encryption practices, and operational monitoring were tested by an outside firm over time, which is genuinely useful supporting evidence for that reasonable-security expectation.
| Signal | What it actually verifies | Does it verify FERPA compliance directly? |
|---|---|---|
| SOC 2 Type II audit (Brisk Teaching, 2025) | Security controls: access management, encryption, monitoring, tested over a period, not just a snapshot | No; it verifies security practices, not FERPA's specific school-official and consent framework |
| National Data Privacy Agreement (executed in ~24 states) | FERPA- and state-law-specific contractual duties, enforceable per state | Yes, for the states and scope actually covered |
| Common Sense Privacy Program score (93%) | Independent evaluation against a 200-plus-question privacy rubric | Partially; it evaluates privacy practices broadly, not FERPA's legal test specifically |
| 1EdTech TrustEd Apps Seal | Assessed certification against 1EdTech's own data-privacy criteria | Partially; a real third-party review, though not FERPA-specific |
Read together, the pattern is a genuinely strong stack of independent signals for a company Brisk's age, founded in 2023 (TechCrunch, 2025). None of them, individually or combined, is the government FERPA certification a vendor cannot actually earn. The NDPA remains the one instrument on this list built specifically to do FERPA's legal work.
Brisk Boost and FERPA's "Direct Control" Requirement
Brisk Boost, the platform's teacher-configured student chatbot feature, raises a FERPA question that is subtly different from the COPPA consent question covered in Is Brisk Teaching COPPA Compliant?: not whether a parent consented, but whether a district can actually demonstrate "direct control" over a live, generative conversation the same way it can over a document a teacher chose to submit. FERPA's school-official exception assumes the school is steering what the vendor does with the data, not just approving that the vendor exists.
A teacher-submitted essay run through Targeted Feedback is a bounded, single input the teacher selected. A Boost conversation unfolds in real time, shaped by whatever a student actually types, which makes "direct control" a slightly different exercise: less about a single data-sharing event and more about whether the grounding material, session boundaries, and transcript-retention settings a teacher configured actually keep the interaction inside the scope a district authorized.
- Confirm whether your NDPA exhibit or DPA names Boost specifically, not only the document-based feedback tools that predate it in Brisk's product history.
- Treat Boost's grounding material as the practical expression of "direct control" in this context: a teacher-authored boundary is what keeps a live chatbot's output inside the scope a district actually approved.
- Confirm whether Boost transcripts are retained by default, since a retained transcript tied to a specific student is a more conventional education record than the discarded-source-text pattern the rest of Brisk's tools follow.
A Practical FERPA Checklist Before a District-Wide Brisk Rollout
Work through these in order before treating Brisk as cleared for every classroom, not only a pilot group.
- Confirm your state appears on Brisk's actually-executed NDPA list, not merely a state where the NDPA framework is available in principle.
- Request the specific exhibit language, confirming whether it names Brisk Boost or only the document-based tools.
- Ask for the SOC 2 Type II report itself, or a summary letter, rather than treating the badge on a webpage as sufficient on its own.
- Clarify your school's retention default for Boost transcripts, since that setting determines whether a live chatbot session becomes a persistent education record or not.
- Confirm which underlying AI model or models process submitted content, since Brisk's own public materials describe a multi-model setup without naming every provider by name.
The same underlying evaluation applies to any AI vendor a district is comparing against Brisk, not just this one tool. Diffit and Student Data Privacy: What Teachers Should Know walks through the equivalent picture for a differentiation-focused tool many of the same classrooms already use, and Is Canva for Education FERPA Compliant? applies the same DPA-first test to a very different kind of product. Unlike Brisk's NDPA-plus-audit combination, Is Edpuzzle FERPA Compliant? covers a vendor that took a different route entirely: an actual iKeepSafe Safe Harbor assessment, still not a government certification, but a different kind of third-party evidence worth comparing side by side.
Where a Different Workflow Avoids the Extension-Permission Question Entirely
A teacher who wants review material without granting any browser extension access to a live document at all has another option worth knowing about. EduGenius can generate a differentiated worksheet, quiz, or writing prompt directly from a class profile set to a grade level and subject, with no student document or submission ever needing to touch a browser extension in the first place. That is a different workflow than a tool layered on top of Google Docs, better suited to building an assignment from scratch than to giving feedback on one already written, and it sidesteps this article's entire "what counts as a maintained record" question by never creating the record in the first place.
Pro Tips for a FERPA-Focused Brisk Review
- Separate the SOC 2 question from the FERPA question in your own documentation, even though both often get cited on the same privacy page. One verifies security controls; the other requires a signed agreement.
- Ask specifically about Inspect Writing's retention period. Its edit-history replay is a more persistent record than the discard-after-task pattern that applies to most other tools in the product.
- Treat Brisk Boost as its own review item, not an automatic extension of whatever agreement already covers the document-based tools.
- Revisit the executed-states list annually. Brisk's NDPA adoption has expanded since its 2023 founding, and a state absent from the list at your last review may be present now.
- If your school is weighing a broader AI classroom assistant against a browser-extension model like Brisk's, SchoolAI vs Khanmigo: Which Is Better for Teachers? is a useful reminder that even tools built for similar purposes document their compliance very differently.
What to Avoid
- Treating the SOC 2 badge as a FERPA certification. It is real, independent evidence of security practices, not a substitute for a signed data-privacy agreement.
- Assuming your state's presence on the NDPA framework generally means Brisk has executed it for your state specifically. Confirm the actual signed exhibit.
- Rolling out Brisk Boost under an agreement written for the document-based tools alone. Boost's live, generative design is different enough to warrant its own explicit confirmation.
- Assuming "no source text retained" means "no education record exists at all." The generated output and usage metadata can still be records a school maintains, even when the original document is not.
Key Takeaways
- FERPA (20 U.S.C. § 1232g) has no vendor-certification program. Brisk Teaching's real compliance posture rests on a signed National Data Privacy Agreement, not its marketing language.
- The NDPA is a FERPA-specific instrument, built by the Student Data Privacy Consortium and executed by Brisk in roughly two dozen states, a meaningfully stronger claim than a general self-attestation.
- Brisk's trigger-based extension design limits, but does not eliminate, its FERPA-relevant footprint. The source text is discarded after a task, but the generated output and usage logs can still count as education records.
- A SOC 2 Type II audit, completed as of October 2025, verifies security controls, not FERPA compliance itself, and the two should be evaluated as separate questions.
- Brisk Boost raises a distinct "direct control" question under FERPA, separate from the COPPA consent question its live, student-facing design also triggers.
- A district's NDPA exhibit should be checked for whether it actually names Boost, since document-based tools and a live chatbot are different enough to warrant separate confirmation.
- Inspect Writing's edit-history replay is a more persistent record than Brisk's typical discard-after-task pattern, worth its own retention-policy question.
Frequently Asked Questions
Is Brisk Teaching FERPA compliant?
Brisk Teaching cannot be "FERPA compliant" the way a certification badge implies, since FERPA regulates schools rather than certifying vendors. It has executed a National Data Privacy Agreement, a FERPA-specific instrument, in roughly two dozen states, which is stronger evidence than a general self-attestation, though a district's own signed agreement still does the actual legal work.
Does Brisk Teaching's SOC 2 certification mean it is FERPA compliant?
No. A SOC 2 Type II audit, which Brisk completed as of October 2025, verifies security controls like access management and encryption over a sustained period. It says nothing directly about FERPA's school-official and consent framework, which is a separate legal question a signed data-privacy agreement addresses instead.
Does Brisk Teaching keep a record of my student's essay after giving feedback?
Not the original text, according to Brisk's own published security documentation, which states the underlying document is not retained once a feedback task completes. The generated feedback output and a log that the request occurred are typically retained, which can still qualify as an education record if tied to an identifiable student.
Is Brisk Boost covered by the same FERPA agreement as Brisk's grading tools?
Not automatically. Boost is a live, student-facing chatbot with a different data pattern than the document-based feedback and grading tools, so a district should confirm directly whether its specific NDPA exhibit or DPA names Boost rather than assuming broader coverage.
What is the National Data Privacy Agreement, and is it the same as a government FERPA certification?
The National Data Privacy Agreement (NDPA) is a standardized contract template built by the Student Data Privacy Consortium specifically to document a vendor's FERPA, COPPA, and state-law duties. It is a real, enforceable contract a state or district adopts, not a government certification, since FERPA has no certification program for any vendor to earn.
Related Reading
- AI, FERPA & COPPA: The Complete School Data-Privacy Guide (2026)
- Brisk Teaching and Student Data Privacy: What Teachers Should Know
- Diffit and Student Data Privacy: What Teachers Should Know
- Is Khanmigo FERPA Compliant?
- Is Edpuzzle FERPA Compliant?
- Is Canva for Education FERPA Compliant?
- SchoolAI vs Khanmigo: Which Is Better for Teachers?