IT Admin FAQ

Audience: School and district IT administrators evaluating StandUp for classroom use. Last updated: 2026-04-05 Maintainer: Daniel (founder) — danielnwah123@gmail.com

This document answers the questions IT admins most often ask ed-tech vendors during a security and privacy review. It is seeded directly from the March 2026 review conversation with Michael Fort (Manager of IT Operations, Baltimore County Public Schools). Questions Michael raised explicitly are marked [BCPS]. Everything here is written plainly — if something is not yet true, it says so, and it says when it will be.

If you need something this FAQ does not cover, email danielnwah123@gmail.com. For deeper docs referenced below, see the Trust Center at /trust.

A. Data & Privacy

Q1. Where is student data stored, and in which region? [BCPS]

All application data (accounts, classes, questions, answers, lesson materials, quiz results) is stored in Supabase (Postgres) hosted on AWS in the US-East region. File uploads live in Supabase Storage in the same region. No student data is stored outside the United States. See /security for the full infrastructure diagram.

Q2. Who inside StandUp can access student data?

Only the founder (Daniel) has production database access today. Access is gated by Supabase service-role credentials stored in Vercel environment variables — not committed to source, not shared. When StandUp hires its first operations person, access will be provisioned via least-privilege roles and logged. All access to production is recorded in Supabase audit logs.

Q3. How do I delete a specific student's data on request? [BCPS]

Email danielnwah123@gmail.com with the student identifier (email or class + name). Deletion is completed within 7 days and you receive written confirmation. Deletion removes the student row, all authored questions/answers, chat transcripts, quiz attempts, uploaded files, and any derived embeddings. See /privacy#deletion.

Q4. What happens to all data if we terminate the contract? [BCPS — "data purge requirement"]

On contract termination we purge all district data within 30 days and provide a signed written attestation of destruction. Before purge, you get a 30-day export window to download everything in JSON + CSV. This matches the BCPS requirement Michael Fort raised in our March meeting. See /dpa §7.

Q5. Are you FERPA compliant? [BCPS]

Yes. StandUp operates as a "school official" under FERPA 34 CFR §99.31(a)(1)(i)(B): we perform an institutional service, we are under the direct control of the school regarding use of education records, and we do not redisclose or use PII for any purpose other than the one for which the disclosure was made. See /privacy#ferpa and the FERPA policy at /legal/ferpa-policy.

Q6. What about COPPA and students under 13?

StandUp's Terms of Service set a minimum age of 13. Districts deploying to K-6 should treat StandUp as out of scope until COPPA support ships (deferred; see /trust#roadmap). Schools remain the verifiable consent holder under the "school authorization" exception if they choose to onboard under-13 users anyway — we require written district authorization before enabling those accounts.

Q7. Do you sell student data or share it with advertisers?

No. StandUp has no advertising, no ad networks, no data brokers, no analytics resale. Revenue comes only from school and student subscriptions. This is a contractual commitment in the DPA (/dpa §4).

Q8. Do you use student data to train AI models? [BCPS-adjacent — Michael asked about AI data handling]

No. Student prompts and content are never used to train any model — ours or a sub-processor's. Anthropic and OpenAI are contractually bound (via their business terms) to not train on API inputs. See /legal/ai-subprocessors.

B. Infrastructure & Security

Q9. What cloud providers do you use?

• Vercel — application hosting and edge network
• Supabase (AWS US-East) — Postgres database, auth, storage
• Anthropic — Claude API for AI tutor and quiz generation
• OpenAI — GPT API as failover provider (can be disabled per-district)

Full sub-processor list and each vendor's posture: /legal/ai-subprocessors.

Q10. Is data encrypted in transit and at rest? [BCPS]

Yes. In transit: TLS 1.2+ on every connection (browser ↔ Vercel, Vercel ↔ Supabase, Vercel ↔ AI providers). At rest: AES-256 via Supabase/AWS-managed encryption for Postgres and Storage. Secrets are encrypted in Vercel's environment variable store.

Q11. Do you support SSO (Google Workspace, Clever, ClassLink)?

• Google Workspace SSO: Live today via Google OAuth.
• Clever / ClassLink: On the roadmap, scheduled for the first paid pilot onboarding.
• SAML: Available on request for enterprise deployments.

Q12. How is row-level data access controlled?

Supabase Row-Level Security (RLS) is enabled on every table containing user data. Policies enforce that students can only read their own rows and the classes they belong to; teachers can only read rows scoped to classes they own. RLS is tested via the evals/ suite on every deploy.

Q13. Do you keep audit logs?

Yes. Supabase logs all authentication events, admin actions, and database mutations. Vercel logs all requests at the edge. Logs are retained for 90 days and available to districts on request during an investigation.

Q14. What certifications do you have (SOC 2, ISO 27001)?

None currently. StandUp is pre-revenue and solo-founded. SOC 2 Type II is on the roadmap post-first-revenue (estimated 6-12 months after first paid pilot; budget $20-50K). We are transparent about this because pretending otherwise wastes everyone's time. Until then, our posture is documented in /security and this FAQ.

Q15. Do you do penetration testing? [BCPS — Michael asked directly]

Here is the plain answer:

• Today: Automated security scanning (OWASP ZAP-class tooling) runs against staging as part of release hygiene. Scan results are kept in an internal log and can be shared under NDA.
• Third-party pen test: Not yet performed. It will be triggered by whichever of these happens first:
  1. First signed paid pilot contract ($5K+ ARR), or
  2. Closing a funding round of $25K or more, or
  3. An IT admin at a target school explicitly requesting it as a closing condition.

No euphemisms: a third-party pen test has not been done. The trigger conditions above are the commitment.

C. AI Specifically

Q16. Which AI providers do you use and what data do you send them? [BCPS]

• Anthropic (Claude) — primary. Sends: lesson text, student question text, sanitized chat history.
• OpenAI (GPT) — failover. Sends: the same payload only when Claude is unavailable.

What is never sent to an AI provider: student full name, email, phone number, student ID, school-assigned identifiers, IP addresses. Names are replaced with a neutral token ("Student") before the prompt leaves our servers. See /legal/ai-subprocessors for the full field-by-field list and lib/ai-provider.ts for the code path.

Q17. Can we opt out of a specific AI provider?

Yes. Per-district configuration lets you pin traffic to Claude only (or OpenAI only) and block the other. Some districts prefer this for vendor-consolidation reasons. Flip is done on our side; takes under a business day.

Q18. What is the retention policy at the AI providers?

• Anthropic: Zero training on API traffic; inputs retained only for abuse monitoring per Anthropic's business terms. We reference their DPA as the sub-processor agreement.
• OpenAI: Zero training on API traffic for business-tier use; 30-day abuse-monitoring retention per OpenAI's business terms.

Both agreements are linked at /legal/ai-subprocessors.

Q19. How do you prevent the AI tutor from becoming a bullying or harassment vector on the anonymous Q&A board? [BCPS — Michael raised anonymous Q&A concerns]

Every post passes through AI moderation before going live. Questions and answers submitted on the Q&A board are scored for harassment, hate, sexual content, self-harm, and personal attacks before they are visible to anyone else. Flagged posts are held for teacher review. Teachers also have one-click removal and a class-level kill switch to disable Q&A entirely. This is baked into the product — not an add-on.

Q20. Can a teacher turn AI features off entirely?

Yes. There is a class-level toggle for the AI Tutor and a district-level kill switch for all AI features. If the AI provider is unavailable or disabled, the rest of the platform (Q&A board, CatchUp recaps, file sharing, classes) continues to function. See /security#ai-kill-switch.

D. Operational

Q21. What is your uptime target and incident response process?

Target: 99.5% availability (Vercel + Supabase baseline). Incidents are triaged by severity (SEV-1 through SEV-4). Notification timeline: within 72 hours of confirmed incident involving student data, matching FERPA expectations. Full runbook: /legal/incident-response.

Q22. Who do we contact for support?

• Primary: Daniel (founder) — danielnwah123@gmail.com, response within 1 business day.
• Security incidents: security@standup-learn.com, response within 4 business hours during US Eastern business days, 24 hours off-hours.
• After first ops hire: a dedicated support role will be added and this FAQ updated.

Q23. How do we export our data?

Teachers can export their class data (questions, answers, student rosters, quiz results) as CSV or JSON from the teacher dashboard. District-wide export is available on request and completed within 7 business days. Export format is documented in /trust#data-export.

E. Procurement

Q24. Do you have a DPA template we can start from? [BCPS]

Yes. StandUp's DPA is based on the SDPC National Data Privacy Agreement — the template most US school IT admins already recognize. It is pre-filled with our actual data handling practices; school-specific fields are blank for your legal team. A Maryland-specific exhibit is available as an optional attachment for Maryland districts. Download: /dpa.

Q25. What does pricing look like?

Current list pricing: $15/student/year with volume discounts starting at 1,000 students. For very large districts (10K+ students) we expect to land closer to $3-5/student/year — this was specifically discussed with BCPS. Pilots (under 150 students) are free for the first semester to remove procurement friction entirely.

Q26. Do you have references from other schools?

StandUp is pre-revenue and currently in grassroots pilots at Maryland community colleges (CCBC, Towson) and targeted private schools (Calvert Hall, Hartford Day, Baltimore Friends — names Michael Fort suggested as good fits). We will connect you directly with a pilot teacher on request. We will not invent references we do not have.

Q27. Does StandUp upload or store district curriculum? [BCPS — Michael flagged curriculum upload as a policy violation]

No. StandUp does not require uploading district-owned curriculum. Teachers can optionally upload their own lesson materials (slides, notes) that they already own and control. For districts that forbid external curriculum storage (as BCPS does), StandUp works fine without any materials uploaded — the AI tutor uses only what the student types in a given session. This was a specific concern Michael raised and it is resolved at the product level, not via policy workaround.

Q28. Common Cartridge / LTI support? [BCPS]

• LTI 1.3: On the roadmap, scheduled alongside Clever/ClassLink SSO. See memory/reference_lti_integration.md for implementation plan.
• Common Cartridge: Evaluating. Michael Fort flagged this as the standard that would make StandUp importable into any LMS (Schoology, Canvas, Blackboard) with minimal engineering on the district side. We are treating this as a high-priority item for the first paid pilot.

Cross-References

• Privacy Policy: /privacy
• Security Practices: /security
• DPA (SDPC-based + MD exhibit): /dpa
• AI Sub-Processors: /legal/ai-subprocessors
• Incident Response Runbook: /legal/incident-response
• FERPA Policy: /legal/ferpa-policy
• Trust Center (landing): /trust

If any answer in this FAQ contradicts something a StandUp employee tells you in email, the FAQ is the source of truth — please forward the discrepancy to danielnwah123@gmail.com so we can correct it.

Appendix A: Questions Michael Fort Raised (BCPS, March 2026)

This appendix exists because the March 2026 security review conversation with Michael Fort (Manager of IT Operations, Baltimore County Public Schools) shaped this entire document. It is kept as a traceability record so future reviewers can see that real district concerns — not hypothetical ones — seeded the FAQ.

Direct quotes from the BCPS meeting that shaped specific answers

• Data purge: "If the contract terminates, we need all data purged and proof of destruction." → Q4 commits to 30 days + written attestation.
• Curriculum ownership: "BCPS owns its curriculum. Uploading it to an external system is a violation." → Q27 confirms StandUp does not require curriculum upload and works without it.
• Procurement thresholds: $5K sole-source, $25K sealed bid, $100K full RFP. → Q25 documents pricing in a way that keeps first pilots under the sole-source threshold.
• Common Cartridge: Flagged as the interoperability standard that would unlock Schoology/Canvas/Blackboard with minimal district engineering. → Q28 treats it as first-paid-pilot priority.
• Anonymous Q&A: Concern that anonymous posting can turn into bullying. → Q19 documents that every post passes AI moderation before going live, plus teacher review and kill switch.

Appendix B: What this FAQ does not cover (yet)

Being explicit about gaps is part of being trustworthy. These are the questions an IT admin might reasonably ask that this FAQ does not yet answer — each has a target date or trigger condition.

• SOC 2 Type II report — not started. Triggered by first paid pilot revenue; 6-12 month timeline thereafter.
• Third-party pen test report — not performed. See Q15 for trigger conditions.
• Under-13 / COPPA deployment guidance — deferred. ToS minimum age is 13 today.
• Clever / ClassLink rostering — on the roadmap, targeted for first paid pilot onboarding.
• SAML SSO — available on request; not self-serve yet.
• Continuous compliance monitoring dashboard — future milestone.
• ISO 27001 — not applicable at current stage.

If any of these gaps is a hard blocker for your district, please tell us directly — it meaningfully changes our roadmap priority.

Appendix C: How to escalate if this FAQ does not answer your question

1. Email danielnwah123@gmail.com with the subject line IT Review — [District Name]. Expect a response within one business day.
2. For urgent security questions, email security@standup-learn.com. A 4-hour response window applies during US Eastern business hours.
3. For legal/DPA review, attach your preferred DPA template and we will red-line against ours within 5 business days.
4. For a live call, include two or three 30-minute windows in your email; we will confirm one.

Because StandUp is solo-founded, every one of these emails reaches the founder directly. No ticketing system sits between you and a real answer.