IEP Desk is built on a foundation of trust. This page explains — in plain language — the specific commitments we make to every family who uses the Service, and the technical measures that back them up.
Every piece of information you enter — your child's name, their goals, their documents — belongs to you. You can export it or delete it at any time, no questions asked.
IEP Desk is funded by subscriptions, not by advertising. Your data is not a product. We have never sold user data and we never will.
Documents you upload are analyzed by AI and then discarded. Anthropic's API terms prohibit using API data to train models. Your child's IEP is not training data.
IEP documents you upload are stored in a private, encrypted bucket and are never deleted unless you choose to do so. Specialist reports shared with an advocate are stored temporarily (maximum 30 days) and deleted automatically once downloaded or expired.
If you invite an advocate, you choose exactly which modules they can see. Advocates have read-only access and cannot modify any of your data. You can revoke access at any time, module by module.
Messages exchanged with your advocate are private, linked to your child's profile, and never shared with third parties. They are permanently deleted when you close your account.
Promises are only as good as the systems that enforce them. Here is what we have actually built to make these commitments technically enforceable — not just contractually stated.
Our database enforces security at the data layer — not just the application layer. Even if there is a bug in our application code, the database itself will refuse to return your data to anyone who is not you.
All data stored in our database and document storage is encrypted at rest using AES-256 encryption — the same standard used by financial institutions and government agencies.
All data transmitted between your device and our servers uses TLS 1.3, the most current and secure version of the Transport Layer Security protocol. Data in transit is encrypted end-to-end.
Uploaded IEP documents are stored in a private, access-controlled storage bucket on Supabase. There are no public URLs that can be guessed or discovered. Access requires authenticated credentials.
We use Anthropic's API under terms that explicitly prohibit the use of API data for model training. When your document is analyzed, the data is processed and discarded — it is not stored by the AI provider.
Production database access is restricted to authorized technical personnel only, governed by least-privilege principles. No employee has routine access to user data without a specific, logged reason.
IEP Desk allows parents to invite an IEP advocate and selectively share specific modules with them — such as their child's IEP plan, meeting preparation, diary, documents, progress tracking or specialist reports. This sharing is always explicit, controlled by the parent, and revocable at any time.
IEP Desk may in the future use anonymized, aggregated data — information that has been stripped of all personally identifiable information and cannot be linked to any individual user or child — to produce general research or insights about the IEP system. For example, we might publish a report on the most common types of IEP goals across disability categories, using data that cannot be traced to any individual.
We will never include personally identifiable information in any such research. Before initiating any aggregated data research program, we will update our Terms of Service and Privacy Policy to provide full transparency, and we will provide users with the ability to opt out.
IEP Desk uses the Anthropic API to power AI document analysis and the AI Legal Assistant. We have reviewed Anthropic's API usage policy and confirmed that data submitted through the API is not used to train Anthropic's models. You can review Anthropic's usage policy at anthropic.com/legal/aup.
We minimize the data sent to the API to only what is necessary for the specific analysis or question at hand. We do not send personally identifiable information (such as your child's name or school) in API prompts where it is not required for the task.
If you believe IEP Desk has violated any of the commitments on this page, or if you have concerns about how your data is being handled, contact us directly at the email address below. We will respond within 5 business days and investigate all concerns thoroughly.
Privacy concerns can also be raised with your state's Attorney General office or, for California residents, with the California Privacy Protection Agency (CPPA).
IEP Desk
Email:
This page is a statement of commitment, not a legally binding contract on its own. The legally binding provisions governing data handling are contained in our Privacy Policy and Terms of Service. In the event of any conflict between this page and those documents, the Privacy Policy and Terms of Service govern.