Privacy & Security
Ownership & Control of Your Student Data
Ownership & Control of Your Student Data
Because our data storage practices comply with data retention laws, and our Privacy Policy is governed by FERPA, PIPEDA, GDPR and all established federal, regional, and international regulations, Xello customers can rest assured their data will never be accessed or used in unauthorized ways.
Our Pledge of Student Privacy
Our Pledge of Student Privacy
Xello has signed the national Student Privacy Pledge regarding the collection, maintenance, and use of student personal information. The pledge states: “School service providers take responsibility to both support the effective use of student information and safeguard student privacy and information security.”
Assurance of Safe Data Storage
-
Family Educational Rights and Privacy Act Regulations (FERPA)
-
General Data Protection Regulation (GDPR)
-
Children’s Online Privacy Protection Act (COPPA)
-
Personal Information Protection and Electronic Documents Act (PIPEDA)
-
Education Law Section 2-D (EdLaw 2D)
Access 4 Learning Community Member
Access 4 Learning Community Member
Composed of more than 3,000 schools, districts, local authorities, states, US and International Ministries of Education, software vendors and consultants, this non-profit collaboration addresses all aspects of information management and access to support learning.
Xello’s Commitment
Xello is accessible by all students, educators, and their communities, while maintaining the highest standards of privacy, security and data protection.
Here's how we do it:
-
Secure Software Development – This includes integrating vulnerability scanning, as early as the development phase, and regular testing.
-
Secure infrastructure – Xello leverages modern technologies such as web application firewalls, intrusion detection and prevention systems to protecting all systems.
-
Data Privacy & Residency – We take the utmost care to ensure data privacy is maintained, including a commitment to:
- Not selling, sharing or leveraging data for any purpose other than the provision of our services.
- Ensuring data stays in the country of its origin.
- A zero trust approach to who can access client data, with multiple layers of encryption.
3rd Party Audits
-
SOC2 Type 2 - An annual assessment measuring compliance with various controls in relations to security, confidentiality and availability.
-
CyberEssentials - An annual assessment measuring compliance to the standards developed by IASME and the National Cyber Security Centre.
What to Look For When Evaluating Your Next Software Supplier
