SDPC National DPA Alignment

1. What Is the SDPC National DPA?

The Student Data Privacy Consortium (SDPC) is a collaborative of schools, districts, regional education agencies, and state departments of education working to address privacy concerns around student data. The SDPC National Data Privacy Agreement (NDPA) is a standardized agreement template that allows districts to efficiently execute privacy agreements with multiple vendors using a single, negotiated framework.

The NDPA v2.1 covers:

• Vendor obligations: What the vendor (ThinkKits) can and cannot do with student data
• Data use restrictions: No selling, no behavioral advertising, no profiling of students
• Security requirements: Industry-standard controls for protecting data in transit and at rest
• Breach notification: Timeline and process for notifying districts of security incidents
• Data deletion: District rights to request deletion of data upon contract termination
• Sub-processor disclosure: Transparency about third-party services ThinkKits uses

2. Our Alignment Summary

ThinkKits has reviewed the NDPA v2.1 requirements and assessed our compliance posture across all requirement categories. Here is the summary:

The three “partially met” items relate to district-uploaded custom data functionality that is available on Enterprise tier only. For districts using the standard platform (which accesses only public federal datasets), all 29 applicable requirements are fully met.

3. NDPA v2.1 Requirement Checklist

The following table maps NDPA v2.1 requirements to ThinkKits’s current practices. “Req ID” references the NDPA section numbering.

Req ID	NDPA Requirement	Status	ThinkKits Implementation
2.A	Vendor will not sell student PII	✔ Met	ThinkKits does not sell student data. Revenue is generated solely through platform subscriptions.
2.B	No behavioral advertising targeting students	✔ Met	ThinkKits does not display advertising on the platform. No behavioral tracking of students.
2.C	No building student profiles for non-educational purposes	✔ Met	School-level profiles are built from public data only. No individual student profiles are created.
3.A	Use student data only for agreed-upon educational purposes	✔ Met	Data is used exclusively to power school intelligence features described in the contracted service.
3.B	No combining district student data with data from other sources to build student profiles	✔ Met	ThinkKits does not receive student-level data from districts. No cross-district student data merging occurs.
4.A	Implement industry-standard security practices	✔ Met	TLS 1.3 in transit, AES-256 at rest, MFA, RBAC. Full details: Security Overview.
4.B	Encrypt data in transit and at rest	✔ Met	All data in transit encrypted via TLS 1.3. All data at rest encrypted via AES-256.
4.C	Access controls and authentication	✔ Met	Role-based access control (RBAC), mandatory MFA for admin accounts, API key management.
5.A	Breach notification within 72 hours of discovery	✔ Met	Documented Incident Response Policy requires district notification within 72 hours of confirmed breach. See Incident Response.
5.B	Breach notification includes scope and remediation steps	✔ Met	Incident notification template includes: scope of affected data, timeline of discovery, root cause, remediation steps, and point of contact.
6.A	Return or destroy student data upon contract termination	✔ Met	District-provided data available for export for 30 days post-termination; permanently deleted after 90 days. Certificate of destruction available upon request.
6.B	District right to request data deletion	✔ Met	Districts may request deletion of any district-provided data at any time by contacting privacy@thinkkits.com. Deletion completed within 30 days.
7.A	Disclose sub-processors (third parties with data access)	✔ Met	Full sub-processor list published at Sub-Processors. Updated list provided 30 days before adding new sub-processors.
7.B	Sub-processors bound by equivalent data protection requirements	✔ Met	All sub-processors are bound by Data Processing Addendums (DPAs) with equivalent FERPA/student privacy protections.
8.A	FERPA compliance as school official or service provider	✔ Met	ThinkKits processes only publicly available NCES school-level data and is not subject to FERPA (no student education records accessed or stored). Full FERPA statement: FERPA Compliance.
8.B	COPPA compliance for services involving children under 13	✔ Met	The ThinkKits platform is a B2B tool for education professionals. It is not accessible to students. Children under 13 are not permitted to create accounts. Full COPPA statement: COPPA Compliance.
9.A	Publish a privacy policy describing data practices	✔ Met	Privacy Policy published at Privacy Policy. Includes data collection, use, retention, and sharing practices.
9.B	Privacy policy includes student data practices	✔ Met	Privacy policy explicitly addresses student data: what we collect, what we do not collect, and FERPA rights.
10.A	Vendor will comply with district-specific state privacy laws	✔ Met	ThinkKits monitors applicable state laws (CA SOPIPA, NY Ed. Law 2-d, TX HB 1709, etc.) and executes state-specific addenda where required. See State Compliance.
10.B	Vendor will execute state-specific DPAs upon district request	✔ Met	State-specific DPAs available for CA, NY, TX, and other high-priority states. Contact privacy@thinkkits.com to initiate.
11.A	No changes to data practices without 30-day notice	✔ Met	Material changes to privacy practices communicated via email to district contacts with 30 days’ advance notice and right to terminate.
12.A	Data minimization — collect only what is necessary	✔ Met	ThinkKits collects only platform usage data (login events, feature usage, API calls) and does not collect student PII. Data collection is limited to what is needed for platform operation, billing, and security.
13.A	Audit rights — district may audit vendor data practices	✔ Met	Districts may request a security questionnaire, audit report summary, or vendor security assessment at any time by contacting privacy@thinkkits.com.
13.B	Vendor will cooperate with district audits within 30 days	✔ Met	ThinkKits responds to security questionnaires and audit requests within 10 business days for standard requests; 30 days for complex assessments.
14.A	Transparency about AI and automated decision-making affecting students	✔ Met	ThinkKits AI features generate insights for adult procurement professionals. No automated decisions affecting individual students are made by the platform. AI methodology disclosed at Methodology.
15.A	Deidentification standards — data shared or published must be de-identified	✔ Met	All data in the ThinkKits platform is school-level aggregated data from public federal sources. No individual student records are stored or displayed.
16.A	Vendor staff training on data privacy	✔ Met	All team members with platform access receive FERPA/privacy training during onboarding and annual refreshers. Training completion tracked by HR.
17.A	Vendor will not retain student data longer than necessary	✔ Met	Data retention schedules published at Data Retention Policy. District-provided data deleted within 90 days of contract termination.
18.A	Vendor maintains a written privacy program	✔ Met	ThinkKits maintains a documented Privacy Program including policies, procedures, incident response, and annual risk assessments.
E.A	District-uploaded data: access controls prevent cross-district exposure	~ Partial	Available on Enterprise tier only. Tenant isolation is enforced at the API layer; full logical data separation documentation in progress for Q2 2026.
E.B	District-uploaded data: vendor cannot use for model training without consent	~ Partial	Enterprise tier only. District-uploaded data is contractually excluded from AI training. Written consent workflow for opt-in data sharing under development.
E.C	District-uploaded data: portable export in standard format	~ Partial	CSV export is available. JSON/XLSX export for district-provided data available on Enterprise. Full self-service export portal planned for Q2 2026.

4. What Data ThinkKits Does and Does Not Collect

What We Collect

• Account information: Name, email address, and organization for platform authentication
• Usage data: Feature interactions, search queries, API call logs — used for billing, rate limiting, and platform improvement
• Payment data: Processed by Stripe; ThinkKits does not store card numbers or ACH details
• Support communications: Emails and chat messages sent to our support team

What We Do Not Collect

• Student names, SSNs, dates of birth, addresses, or any other student PII
• Individual student academic records, grades, or disciplinary records
• Any data from student devices, logins, or in-classroom tools
• Biometric data of any kind

Public Education Data in Our Platform

All school and district data displayed in the ThinkKits platform is sourced from publicly released federal datasets: NCES Common Core of Data, EdFacts, USAC E-Rate, Census SAIPE, and related sources. This data is school-level aggregated and fully de-identified. It is the same data available to any member of the public via government websites — ThinkKits simply makes it searchable and actionable.

Sub-Processors

ThinkKits uses the following categories of sub-processors that may have access to district or platform data:

• Cloud hosting: Railway (US-based; SOC 2 Type II certified)
• Vector database: Pinecone (US-based; SOC 2 Type II certified)
• Graph database: Neo4j (Railway) (US-based; enterprise security controls)
• Payment processing: Stripe (PCI DSS Level 1 certified; does not access education data)
• Email/calendar: Microsoft 365 (FERPA-compliant; BAA available)
• Error monitoring: Sentry (receives anonymized error logs; no PII)

Full sub-processor details: Sub-Processors List

5. How to Request NDPA Co-Signature

ThinkKits will execute the SDPC NDPA v2.1 with any district or LEA that requests it. The process is simple and takes fewer than 10 business days from request to fully executed agreement.