For Texas Districts · Updated October 19, 2026
Built to sign the Texas NDPA.
What the TX-NDPA and Texas law require of a student-data vendor, and what Agenteach provides — requirement by requirement, with links to the published artifacts your review team will ask for.
Our position, in one sentence: Agenteach signs the SDPC Texas Student Data Privacy Agreement (TX-NDPA v1r6) with its standard protections intact — we do not use Exhibit H to weaken them — and every obligation below remains mandatory. Before Attend handles real district data, we will enforce access, audit, AI-context, and retention controls across its new records and workflows.
Requirement by requirement
Sources are cited for your convenience; the signed DPA is always the controlling document.
| What Texas requires | What Agenteach provides |
|---|---|
| The district owns all student data. The vendor takes no license beyond providing the service.TX-NDPA Art. II | Ownership is stated in our public Terms §4 and Privacy Policy §2: all student data belongs to the LEA. We operate as a FERPA school official under the district's direct control. |
| Protections extend to all "LEA Data" — not just student records: staff, guardian, and operational data too.TX-NDPA Exhibit G §1 | We apply DPA protections to teacher and staff accounts, guardian contact data, and operational records under the same security, breach-notice, and deletion commitments as student data. |
| No sale, no targeted advertising, no profiling.TX-NDPA Art. IV · TEC §32.152 | Committed in our published Privacy Policy and Terms. No advertising, analytics, or session-replay trackers are permitted in Attend, and student data is never used to train AI models. The July 2026 code review covered the earlier implementation only; Attend must satisfy this restriction before handling real district data. |
| Transparent data inventory. Districts must know exactly which data elements the vendor touches.TX-NDPA Exhibit B | A field-level data table is published in Privacy Policy §3; an Exhibit B-aligned data inventory is part of our district procurement pack, available on request. |
| Reasonable security procedures and practices.TX-NDPA Art. V §3 · TEC §32.155 | Encryption in transit and at rest, application-layer token encryption, US-only storage and processing, a managed web application firewall, and security scanning in CI remain required. District-approved SIS/SSO connections use least-privilege scopes through Ednition (SOC 2 Type 2, ISO/IEC 27001 certified). Before Attend handles real district data, we will enforce tenant/school/role/assigned-student checks on every request and database-enforced append-only auditing of sensitive reads, changes, exports, erasures, and every AI call. Full detail: Security & Privacy Architecture. |
| Sensitive records deserve extra care. Restricted counselor notes require explicit permissions; excluded records must stay outside the service.TX-NDPA Art. V · FERPA | Attend does not collect child-welfare reports, disability/IEP/504 or accommodation records, health records, or discipline records, including in notes and drafts. Before real district data, we will enforce counselor-only note permissions in views, reports, exports, and AI context, with audited reads and changes. A person approves family drafts and staff send through district channels; Agenteach never sends them. |
| Breach notification to the district within 72 hours of confirmation, with Texas statutory clocks honored.TX-NDPA Art. V §4, Exhibit G §4 · Tex. Bus. & Com. Code §521.053 | Written notice to your designated DPA representative and district cybersecurity coordinator within 72 hours of confirmation — our target is same business day. We track the Texas statutory clocks (individual notice, Texas AG portal thresholds, consumer reporting agencies) and honor law-enforcement delays, documented in writing. |
| Support the district's own SB 820 / TEA reporting duty. The district must report incidents up its chain "as soon as practicable" — the vendor must feed it facts fast.TEC §11.175 | Our standing District Notification Data Sheet commits to what you get and when — see the timeline below. Before Attend handles real district data, we will enforce tenant-scoped append-only auditing and affected-student/record enumeration by record type and sensitivity, so we can meet the reporting cadence below. |
| Deletion within 60 days of district request.TX-NDPA Art. IV §6 · TEC §32.156 | Student erasure is honored within 60 days — typically immediately — with written confirmation of destruction, subject to the published backup and hold caveats. Before Attend handles real district data, we will verify hard deletion of every linked record and stored legacy file, plus automated daily purge coverage per our Retention & Deletion Schedule. |
| Return of data in a usable format.TX-NDPA Art. IV §6 | We provide complete per-student export packages: every linked record plus correction history and audit metadata. Before Attend handles real district data, we will verify export coverage of all record classes. Export is never blocked by a legal hold, so your counsel can always obtain records even while deletion is suspended. |
| Parent and eligible-student rights flow through the district.TX-NDPA Art. II | We support district-routed access, correction, and deletion requests within 30 days. Before Attend handles real district data, we will enforce append-only correction history for case records and recorded district-channel handoffs, including any legacy sent records, so the record of what changed is never silently lost. |
| Subprocessor transparency and flow-down.TX-NDPA Art. II §5 | Our public Subprocessor List has three service rows from three vendors (Microsoft, Google, and Ednition), each bound by data protection terms. Hosting, AI processing, and Ednition integration are pinned to US regions. Ednition is SOC 2 Type 2 attested and ISO/IEC 27001:2022 certified. Through the approved connection it processes roster/directory, daily attendance/absence codes, guardian contacts where shared, and course grades/credits only when the counselor academic view is district-enabled. It never receives staff-created notes (including restricted notes), contact/home-visit logs, plans, meeting notes, message/summary drafts, report worksheets, Agenteach audit trails, or AI requests/outputs. Ednition is bound by its agreement with Agenteach to process only as instructed, use data only to provide the service, prohibit AI training, keep data confidential, delete it within 60 days of termination, and promptly notify Agenteach in writing of a breach or potential breach. Its Privacy Statement states no sale, advertising, or profiling. See Privacy Policy §7. Districts under agreement receive advance notice of any change. |
| Litigation and investigation holds.District discovery & records-preservation duties | Districts can direct legal holds at student, school, or whole-district scope. Before Attend handles real district data, we will enforce these holds for every record class and permanently audit their full lifecycle. A hold blocks deletion, never export, until released. |
| No biometric identifiers.Tex. Gov't Code ch. 560 | Agenteach collects no biometric data of any kind — and we commit to a documented biometrics assessment before shipping any future audio- or image-analysis feature. |
If an incident ever touches your district
This is the reporting cadence we commit to, so your cybersecurity coordinator can meet the district's TEC §11.175 duties without chasing us:
| When | What your district receives |
|---|---|
| ≤ 72 hours from confirmation target: same business day | Written notice to your DPA representative and cybersecurity coordinator: incident description, affected data categories, date or date range, law-enforcement delay status, and our incident contact. |
| ≤ 5 business days | Affected-student and affected-record counts by record type, with sensitivity-level breakdown and explicit flagging of restricted counselor notes. If excluded child-welfare, disability/IEP/504, health, or discipline records are found contrary to the collection prohibition, they are explicitly flagged too. |
| Every 72 hours until closure | Updated counts, containment status, and remediation steps. |
| At closure | A written incident summary suitable for your board and TEA reporting. |
Incident contact: security@agentea.ch. We cooperate with your SB 820 reporting chain, local law enforcement, and any TEA or Texas AG inquiry.
For your review team
Published and linkable today: Privacy Policy, Terms of Service, Subprocessor List, Retention & Deletion Schedule, and the Security & Privacy Architecture overview. Available on request as part of our district procurement pack: an Exhibit B-aligned data inventory, our AI-use statement, an incident-response overview, and support for HECVAT/CAIQ-style security questionnaires.
In the spirit of the rest of this site: we describe third-party certifications and registry listings as roadmap items until they are formally complete, and we would rather show you a working control than a badge.
This page is a plain-language summary for procurement and technology teams. It is not legal advice, and statutory citations are provided for convenience — the signed DPA between Agenteach and your district is always the controlling document.
Reviewing Agenteach for your district?
We'll walk your privacy, security, and curriculum teams through anything on this page — with the artifacts to back it up.