Quick answer: FERPA regulates the educational institution, not the messaging vendor. The Family Educational Rights and Privacy Act places the obligation on the school that holds education records, and a platform like Devotel Orbit supplies the controls a school configures to carry that obligation: consent capture with an audit trail, per-audience segment isolation, retention windows, a documented deletion workflow, and role-based staff access. There is no such thing as a FERPA-certified vendor, and a platform that sells you a certificate is selling paperwork, not posture. This explainer walks the law in plain language, the school communication patterns that touch it, the controls to configure on a CPaaS, and the checklist to run against any vendor, including ours.
1) What FERPA actually regulates
FERPA (20 U.S.C. § 1232g) applies to educational agencies and institutions that receive funds under programs administered by the U.S. Department of Education, which covers most public K-12 districts and most colleges and universities. Three concepts carry the whole law:
- Education records. Records directly related to a student and maintained by the institution: grades, transcripts, attendance, disciplinary files, class schedules, and the identifiers attached to them. The moment a message you send or receive carries a grade, an absence, or a schedule tied to a named student, it is touching an education record.
- Consent and its exceptions. The default rule is written consent from the parent, or from the eligible student once rights transfer at 18 or postsecondary enrollment, before personally identifiable information leaves the institution. The exceptions do the daily work: directory information, school officials with legitimate educational interests, and health and safety emergencies.
- Directory information. Name, email address, phone number, enrollment status, and dates of attendance may be disclosed without consent when the institution gives annual notice and honors opt-outs. Directory information is why a school may publish a roster, and it is the legal ground most routine school notifications stand on, until a parent opts a student out.
Two facts shape how you evaluate a vendor. First, FERPA has no vendor certification program. The Department of Education's Family Policy Compliance Office enforces the law against institutions, and the sanction is loss of federal funding, not a fine on a software company. Second, a vendor can sit inside the school-official exception when it performs an institutional service the school would otherwise do itself, under the school's direct control and a written agreement that binds the vendor to the same use and re-disclosure limits. That contract designation is what makes a platform permissible for education-record traffic. No badge does.
2) Which school communication patterns touch FERPA
Not all school traffic grades the same under FERPA. The patterns sort into three lanes:
- Account-holder operational alerts. A grade posted, an absence recorded, a schedule changed, a balance due. These carry education-record content to the parent or eligible student who is the intended recipient. The compliance work is access: only authorized staff compose, sends go to the right guardian on file, and the record of what was sent is retained and deletable on the institution's schedule.
- Emergency notifications. Campus closures, lockdowns, weather, public-health notices. The health-and-safety emergency exception and directory information carry most of this traffic, and speed matters more than consent ceremony. The platform question is whether emergency audiences are pre-segmented and reachable on more than one channel when SMS is slow or down.
- Outreach and enrollment campaigns. Open houses, campus tours, application nudges, financial-aid reminders to prospective families. This is marketing traffic aimed at people who may hold opt-outs, and it runs on the consent surface: prior express consent where required, suppression honored across channels, and directory-information opt-outs excluded before the campaign launches rather than after a complaint.
The failure mode in all three lanes is the same: education-record content reaching a recipient or a staff member the institution never authorized. The controls in the next section are the school's answer to that.
3) The tenant-owned controls a school configures on a CPaaS
Devotel Orbit does not ship a "FERPA mode," and you should be skeptical of any platform that claims one, because the posture is assembled from controls the tenant sets. What Orbit ships is that control set, each verifiable in the product:
- Consent capture and audit trail. Opt-in capture on the marketing surfaces, a consent ledger that reads the same contact across every channel, and per-message compliance records that bind a send to the consent it ran on. When a registrar's office needs to show why a message went out, the audit trail answers without a subpoena to the vendor.
- Per-audience segment isolation. Guardians holding directory-information opt-outs, eligible students over 18, staff lists, and emergency audiences stay in separate segments, and campaign targeting selects a segment rather than a hand-built export. Isolation in the platform is what keeps an enrollment campaign from sweeping an opted-out roster.
- Retention windows. Message content and media retained on the window the institution sets, with access logs kept independently of the content window, so a records officer can hold the audit evidence without holding every message body forever.
- Data deletion workflow. The contacts erasure flow runs a re-auth challenge, an immediate delete, and a cancellable erasure request with a visible status envelope, documented end to end in the Contacts erasure docs changelog. A parent's erasure request terminates in a receipt, not a support ticket.
- Staff role controls. Sidebar and settings visibility enforce roles, so a viewer never opens the surfaces an administrator owns, and every send dialog validates its prerequisites before the send button enables. The RBAC and prerequisite-checks changelog walks that surface. The school-official exception lives or dies on access control, so this is the control to demo hardest in any vendor review.
The division of responsibility stays explicit throughout. The institution owns the policy: what counts as directory information this year, which segments exist, which retention window applies, who qualifies as a school official. Devotel Orbit owns the enforcement of the settings the institution chooses, and the infrastructure security underneath them.
4) The vendor evaluation checklist
Ten questions, in the order a school procurement review should ask them:
- Does the vendor state in writing that FERPA obligations sit with the institution, and that no vendor certification exists?
- Will the vendor sign the school-official terms your counsel requires: direct control, legitimate educational interest, and use and re-disclosure limits?
- Where do message content, media, and inbound replies physically rest, and which encryption applies at rest and in transit?
- Can we capture and evidence consent per audience, and does the consent ledger read the same contact across every channel?
- Can we isolate audiences into segments, with opt-outs and directory-information exclusions enforced at send time?
- What retention windows apply to message bodies and media, who sets them, and what survives at expiry?
- What does the deletion workflow return: an immediate delete, a cancellable request with a status envelope, and an exportable receipt?
- Which staff roles can compose, send, export, and read message content, and is that enforced in the interface rather than only in policy?
- Is access to message content logged, and can we export the log for an audit without filing a support ticket?
- Which controls are tenant-owned and which are platform-owned, stated in one table?
A vendor that claims certification at question one has already answered your real question. A vendor that answers question ten crisply is usually answering the other nine honestly.
5) Where the obligation actually sits
FERPA obligations sit with the educational institution as the tenant of record. The platform is a conduit and a control surface: it enforces the segments, windows, deletion, and access rules the institution configures, and it produces the audit evidence the institution discloses. Nothing in this explainer shifts that allocation, and no platform feature can. This is editorial content, not legal advice; your counsel and your records officer own the final read of how FERPA applies to your program.
The same tenant-owned model runs across Orbit's education coverage. The education vertical page maps the channels a school runs on one account, and the education outreach messaging buyer explainer walks the enrollment workflows these controls gate. If your review starts from healthcare-style procurement language instead, the HIPAA buyer checklist is the sibling of this post: same shared-responsibility shape, different statute.
Frequently asked questions
Can a messaging platform be FERPA certified?
No. FERPA has no vendor certification program; the Department of Education enforces the statute against institutions that receive federal education funds. The vendor-side question is whether the platform can operate inside the school-official exception under your written agreement, and whether the tenant controls above let you run the posture yourself.
Do emergency alerts need parent consent?
Emergency notifications generally rest on the health-and-safety emergency exception and on directory information, not on prior consent. The practical requirement is that the institution's own policy defines the emergency audience and that opt-outs from directory information are honored where the institution says they apply. Pre-segmented emergency audiences are the control that makes the exception usable at 2 a.m.
What about students who turned 18?
Rights transfer to the student at 18 or postsecondary enrollment, whichever comes first. A messaging program built around guardian contacts needs a segment for eligible students, because the consent and notice analysis changes the day the student crosses that line. Segment isolation is what keeps the two audiences from bleeding into one campaign.
Is a grade alert different from an open-house invite?
Yes. A grade or absence alert carries education-record content to the account holder and runs in the operational lane, where access control and retention do the compliance work. An open-house invite is marketing traffic aimed at a prospective family and runs on the consent surface. Run both from one account; the controls grade by audience and campaign type, not by channel.