Data Processing Agreement
Last updated: 2026-01-01 · Version 1.0-draft
⚠ [ATTORNEY DRAFT REQUIRED] — This page contains placeholder legal text that has not been reviewed or approved by a licensed attorney. Do not rely on this content for legal compliance. Replace all placeholder sections before production launch.
What Is a DPA?
A Data Processing Agreement (DPA) is a written contract between GradeWise and a school or district that defines how we process student education records on the school's behalf. It establishes the permitted uses of data, our security obligations, deletion timelines, and breach notification procedures.
When Do You Need One?
A DPA is required if your district or state requires a formal agreement before adopting third-party edtech tools — which most US districts and states now do. We recommend all schools using GradeWise request a signed DPA before uploading student work.
What Our DPA Covers
- Scope of data processing and permitted uses
- Prohibition on selling, renting, or disclosing student data
- Data deletion obligations (30 days post-termination)
- Security requirements and incident response
- Breach notification procedures
- Subprocessor list (OpenAI, Railway, Stripe)
- Audit rights
Pre-Signed District Templates
If your district uses a standard DPA template (such as the Student Data Privacy Consortium model DPA), we will review and sign it. Include a note in the request form below.
Request a DPA
Fill out the form below and we will respond within 2 business days with a draft DPA for your district's review.