Security & compliance
The questions General Counsel asks first
CampusLink stores extensive student PII, so it is covered by FERPA the moment a district deploys it. This page is the summary a district's counsel, technology director and business manager each need — including where the boundaries of our responsibility actually sit.
The first answer
Your data does not leave your building
CampusLink is single-tenant and self-hosted. The database runs on district infrastructure, attachments sit on district disk, and backups are taken by district staff under district policy.
There is no vendor-side copy of student records to reason about, no
multi-tenant table with a district_id column separating you
from someone else, and no subprocessor list to review — because there
are no subprocessors holding your data. That removes an entire
category of procurement question before it is asked.
It also transfers real responsibility to the district: you own the server, the backups, the TLS certificates and the uptime. We say so plainly on the deployment page, because a vendor who is vague about this is describing a surprise, not a service.
Who owns what
- District Server, database, backups, DNS, TLS, uptime, staff training, directory-information policy
- CampusLink The application, its permission enforcement, its audit completeness, security fixes, upgrade path
- Melton Electronics Under a managed agreement: install, upgrades, monitoring, backup verification and restore drills on your infrastructure
Districts that want the middle row operated for them buy the managed tier. Districts with their own capable operations team do not need to.
FERPA
Three data tiers, enforced in every module
Access to student data is not one switch. CampusLink separates it into three tiers, checked at the same place in every module — so a permission granted for one surface does not accidentally open another.
| Tier | Covers | Visible to |
|---|---|---|
| Directory data | Name, school, grade level | Most staff roles, per the district Directory Information policy |
| Restricted PII | Free / reduced lunch status, guardian contacts | Roles carrying restricted.pii.read — school admin, registrar, F/R coordinator |
| Confidential records | IEP and 504 indicators, discipline and conduct | Roles carrying confidential.read — school admin, case manager |
Parent right to inspect
FERPA gives parents the right to see their student's education records. Guardians authenticate by magic link into the Guardian portal and see their linked student's tickets, device assignments, policy acceptances and conduct events. Administrators can also produce a full per-user export.
The honest caveat
Free-text fields are the weak point in every K-12 system, and this one is no exception: a helpdesk ticket that names a student in its description becomes an education record. The platform audits access to it, but no software prevents it being written. That is a staff training obligation, and districts should plan for it rather than assume it away.
Controls
What the platform enforces on its own
Controls that depend on someone remembering are not controls. These run whether anyone is watching or not.
Credentials never sit in plaintext
Every App integration secret is AES-GCM encrypted at rest with a key held only in the district’s environment file. A stolen database dump without that key is inert.
Reads are audited, not just writes
Opening a confidential student record is an event. Most systems log the edit and not the look, which is exactly backwards for FERPA.
Retention runs itself
Camera footage extracts scrub automatically at 90 days. Retention policies are configured per data class in the admin UI, and enforced by the background worker rather than by a calendar reminder.
Grants that expire
Scoped grants carry an optional expiry. Temporary access ends on its own date rather than surviving until an audit finds it.
Four-eyes on protected changes
Role edits, footage releases and off-cycle payment releases require a second administrator to co-sign. The initiator cannot be the approver.
Break-glass leaves a mark
Emergency elevated access is a first-class, time-bounded, audited grant — so the alternative (a shared admin password) never gets invented.
Accessibility
WCAG 2.1 Level AA is the target
Level AA is the Section 508 federal baseline and the threshold most state K-12 procurement contracts require. Every page CampusLink ships is built against the practices on the right.
We are not currently certified, and we will not imply otherwise in a procurement document. Certification is a process a district should expect us to pursue on request; in the meantime we accept issues against any surface that breaks the commitments listed, and treat them as defects rather than as enhancements.
Both English and Spanish ship in the product, and every surface works on a phone browser — installable as a PWA, with no separate app to approve through an MDM.
The commitments
- Every interactive control reachable by keyboard, with focus order matching visual order and no keyboard traps
- Visible focus rings on every focusable element
- Body text at 4.5:1 contrast or better; large text and icons at 3:1 or better
- Every image carries an alt attribute — decorative ones deliberately empty
- Every input has a real label; placeholder text is never used as one
- Errors are inline, programmatically associated with the field, and announced to screen readers
- One h1 per page, with heading order maintained in source order
Vulnerability disclosure
Report to [email protected]. Acknowledged within 72 hours, with a fix timeline once triaged.
Answers on the record
CampusLink is proprietary and the source is not distributed. What we do provide, in writing: completed vendor security questionnaires, the FERPA summary, the accessibility statement, and architecture documentation detailing how the permission engine is enforced. If your procurement requires source escrow or code review, say so at the outset — it is a real constraint, not a detail.
Backup and restore
Three stores to protect: the database, the attachments directory, and the environment file holding the encryption key. Without that key the database is unusable — which is a feature, and a thing to put in your DR plan.
Send us your security questionnaire
We would rather answer the long version early than discover a blocker in week six of a procurement. Attach the district's standard vendor assessment and we will complete it.