Overview
KyberGate is built with student data privacy as a foundational principle. This article explains what data KyberGate collects, how it is stored and protected, and how your district can comply with FERPA, COPPA, CIPA, and state student privacy laws.
KyberGate is a signatory of the Student Data Privacy Consortium (SDPC) National Data Privacy Agreement (NDPA), which provides a standardized legal framework for protecting student data.
What Data KyberGate Collects
KyberGate collects only the minimum data necessary to provide web filtering, device management, and safety monitoring:
- Browsing activity — domain names, URLs, timestamps, filter actions (allowed/blocked), and content categories
- Device information — device type, operating system, serial number or UDID, online/offline status, and last check-in time
- User identity — student email address (from Google Workspace, Clever, or ClassLink sync) used to associate activity with a user
- Safety signals — flagged search queries, self-harm keyword matches, and AI-classified content alerts
- YouTube metadata — video titles, channels, and watch duration (not video content)
What KyberGate Does NOT Collect
- Keystroke logging or screen recording
- Email content, chat messages, or file contents
- Passwords or authentication credentials
- Biometric data
- Student grades, disciplinary records, or personal health information
- Data from personal (non-managed) devices unless voluntarily enrolled
Data Storage & Security
- All data is stored in Google Cloud Platform (GCP) data centers in the United States
- Data is encrypted at rest (AES-256) and in transit (TLS 1.3)
- Access is restricted by organization — your district's data is isolated from other organizations
- KyberGate employees access production data only for support and troubleshooting, under strict access controls and audit logging
Compliance
FERPA (Family Educational Rights and Privacy Act)
KyberGate acts as a "school official" under FERPA's legitimate educational interest exception. This means:
- Your district maintains ownership and control of all student data
- KyberGate does not sell, share, or use student data for advertising or profiling
- Parents/guardians can request access to their child's browsing data through the school
- Data is used solely for the educational purpose of internet safety and content filtering
COPPA (Children's Online Privacy Protection Act)
For students under 13, KyberGate relies on the school's consent (under the COPPA school exception) to collect data necessary for the filtering service. KyberGate does not collect data directly from students or require students to create accounts.
CIPA (Children's Internet Protection Act)
KyberGate satisfies CIPA's technology protection measure requirements by providing content filtering and monitoring on student devices. Browsing logs are retained for a minimum of 90 days to support E-Rate compliance documentation.
SDPC National Data Privacy Agreement (NDPA)
KyberGate is a signatory of the SDPC NDPA, a standardized Data Processing Agreement used by thousands of school districts nationwide. The NDPA covers:
- What data is collected and why
- Data security obligations
- Breach notification procedures (within 72 hours)
- Data deletion upon contract termination
- Restrictions on data use (no advertising, no profiling, no third-party sharing)
- Parental rights under FERPA
How to Request the NDPA Vendor Exhibit
If your district uses the SDPC framework and needs KyberGate's Vendor Exhibit:
- Visit kybergate.com/privacy or contact privacy@kybergate.com
- Provide your district name, state, and DPA contact person
- KyberGate will provide the completed Vendor Exhibit (Exhibit E) within 5 business days
- Your district's DPA coordinator can countersign and file it with the SDPC
If your state has its own Student Data Privacy Agreement (many states have adopted the NDPA framework), KyberGate can provide a state-specific exhibit upon request.
Steps for Administrators
Step 1: Review Privacy Settings
In the KyberGate dashboard, go to Settings → Data & Privacy to review:
- Data retention periods
- Which data types are collected
- Who has admin access to student data
Step 2: Configure Retention
Set data retention periods that align with your district's policy and state requirements. See the Data Retention & Automated Purge article for detailed instructions.
Step 3: Export or Delete Data
Under Settings → Data & Privacy → Data Requests, you can:
- Export all data for a specific student (for parent access requests)
- Delete a student's data (for transfer or withdrawal)
- Export organization-wide data for compliance audits
Step 4: Review Access Controls
Ensure only authorized staff have admin access. Use the Team settings to manage roles:
- Admin — full access to all data and settings
- Policy Manager — can edit policies but not view individual student data
- Viewer — read-only access to reports and dashboards
- Teacher — classroom-level access only (via KyberClassroom)
Tips
- Request and file the NDPA Vendor Exhibit before your next board review or E-Rate audit
- Review admin access quarterly to remove departed staff
- Enable automated purge to avoid retaining data longer than necessary
- KyberGate's privacy page (kybergate.com/privacy) contains the full privacy policy, sub-processor list, and DPA contact information
FAQ
Q: Does KyberGate sell student data? A: No. KyberGate never sells, rents, or shares student data with third parties for advertising, marketing, or any non-educational purpose.
Q: What happens to student data when we cancel our subscription? A: Upon contract termination, KyberGate deletes all organization data within 30 days and provides a written confirmation of deletion. You can request a full data export before cancellation.
Q: Can parents see their child's browsing data? A: Parents can request access through the school. The Parent Portal (if enabled by the district) provides parents with a view of their child's browsing activity and alerts. Schools control whether the Parent Portal is available.
Q: Is KyberGate SOC 2 certified? A: KyberGate is pursuing SOC 2 Type II certification. Current security practices align with SOC 2 controls including encryption, access management, monitoring, and incident response.