SOC 2 for EdTech is an independent report on the controls that protect student data, and school districts and universities commonly ask for it alongside FERPA and COPPA commitments. It supports those obligations with evidence, but it does not make a company FERPA or COPPA compliant.
Do EdTech companies need SOC 2?
No law requires EdTech companies to hold SOC 2. Schools and districts often request independent evidence during procurement, so a report can shorten reviews. The obligation itself usually comes from a contract, a district policy or state law, not from the AICPA.
Because requirements differ by state and district, ask each buyer what it requires. This page covers federal FERPA and COPPA only and is general information, not legal advice.
How does FERPA affect EdTech vendors?
FERPA is a federal privacy law that applies to schools and agencies receiving funds from Department of Education programs, and it governs access to and disclosure of education records. Vendors are affected because schools share records with them.
According to the Department of Education, an outside party can be treated as a school official if it performs a service or function the school would otherwise assign to its own employees, the school directly controls how it uses and maintains the education records, and it is bound by limits on reuse and redisclosure. Recipients generally may use the information only for the purpose it was shared and may not pass it on without consent unless an exception applies.
How does COPPA affect EdTech vendors?
COPPA applies to operators of websites and online services that collect personal information from children under 13, including mobile apps. The FTC says covered operators must keep reasonable procedures to protect the confidentiality, security and integrity of children’s information and maintain a written retention and deletion policy.
The FTC’s amended COPPA Rule took effect June 23, 2025, and most provisions required compliance by April 22, 2026. The Federal Register notice also says the FTC did not finalize proposed school-related provisions, pending possible changes to the Department of Education’s FERPA rules. Check the current rule text with counsel.
How does SOC 2 support school-buyer requirements?
SOC 2 supports these requirements by giving schools independent evidence that your controls exist and operate. It maps to what district reviewers look for, but legal compliance still depends on how you collect, use and share data.
| What school buyers want to see | Related SOC 2 evidence |
|---|---|
| Only authorized people can reach student data | Logical access controls, MFA, access reviews |
| Activity on records is tracked | Logging and monitoring controls |
| Vendors with access are managed | Vendor and subservice organization controls |
| Incidents are handled and reported | Incident response controls |
| Data is kept only as long as needed | Retention and disposal controls (Confidentiality or Privacy) |
The mapping is our own approximation, not an official crosswalk. Our SOC 2 control examples show how these controls are described.
Which Trust Services Criteria fit EdTech?
Security is mandatory. EdTech companies commonly add Confidentiality, because student records are sensitive, and Privacy when they collect personal information directly from users. Availability matters when classes depend on uptime. These pairings are common practice, not an AICPA rule.
- Security: required in every SOC 2.
- Confidentiality: classification, encryption and secure disposal of student records.
- Privacy: notice, consent and access requests for personal information.
- Availability: uptime, backups and recovery during the school year.
Read the Trust Services Criteria guide for category detail, and the SOC 2 for SaaS companies page for scoping a hosted product.
Next Assurance scopes SOC 2 examinations around the controls school buyers review. See our SOC 2 audit service.
Frequently asked questions about SOC 2 for EdTech
Is SOC 2 required for EdTech companies?
No law requires it. School districts and universities often request a SOC 2 report in procurement, and some state laws or district policies add requirements. Ask each buyer what it needs. A report supports your answers with independent evidence but does not by itself satisfy FERPA, COPPA or state law.
Does SOC 2 make a company FERPA compliant?
No. FERPA is a federal law governing education records, and compliance depends on how a vendor uses and discloses records, including the school-official conditions set by the Department of Education. SOC 2 can provide evidence of access, logging and vendor controls that support those commitments.
What is a school official under FERPA?
A school official can include an outside contractor or vendor if it performs a service the school would otherwise do with its own employees, the school directly controls how it uses and maintains the records, and it is bound by limits on reuse and redisclosure. The school makes that determination, usually through its contract.
When does COPPA apply to an EdTech product?
When you are an operator of a website or online service, including a mobile app, that collects personal information from children under 13, whether the service is directed to children or you have actual knowledge that you collect it. The FTC lists parental notice, verifiable consent, parental rights and reasonable security among the duties.
Which SOC 2 categories should an EdTech company include?
Security is required. Many EdTech companies add Confidentiality for student records and Privacy where they collect personal information from users, and Availability when classroom use depends on uptime. Pick categories your customer commitments support, because each one adds controls and evidence to maintain.
Do state student-privacy laws matter too?
Yes. Many states have their own student data privacy laws and district contract terms, which can be stricter than federal rules. This page covers only FERPA and COPPA. Ask counsel to review the states where you sell and make sure your contracts and controls reflect each requirement.
Sources
Facts checked against the sources below on October 7, 2026. This page gives general information, not legal advice, and covers federal rules only.
- U.S. Department of Education – FERPA: coverage, school official conditions and redisclosure limits.
- FTC – Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business: who is covered and the core duties.
- Federal Register – Children’s Online Privacy Protection Rule (April 22, 2025): effective June 23, 2025; compliance date April 22, 2026 with an exception.
- AICPA & CIMA – 2017 Trust Services Criteria (With Revised Points of Focus – 2022): the criteria a SOC 2 examination evaluates.
