Security & Privacy
What school district reviewers need to know about DistrictAssist. Staff-only. No student data.
Data we collect
Staff name, district email, and role (from single sign-on). Questions, answers, sources used, and ratings. Documents the district uploads. Standard request metadata (IP address, browser).
No student data.
Where it's stored
Amazon Web Services, U.S. regions only.
- Sub-processors
- Amazon Web Services (hosting, storage, AI through Amazon Bedrock). That is the complete list.
AI use
Answers are generated only from the district's own documents. District content is not used to train AI models.
Separation between districts
Each district's data is kept separate, and every request is limited to the signed-in user's district.
Access control
Single sign-on only. Three roles. Restricted documents are never shown to lower roles. Admin actions are recorded in an activity log.
Encryption
TLS 1.2+ in transit, HSTS. Encrypted at rest (database and file storage).
Retention & deletion
Question history is kept for 12 months. Removing a document deletes it and its extracted text immediately. All data is deleted within 30 days of contract end, or on request.
FERPA & COPPA
DistrictAssist is a staff tool. No student PII is collected, so COPPA does not apply. If a district's documents include education records, Good Day Source acts as a school official under the district's direct control per the data privacy agreement.
Agreements
Good Day Source signs the TX-DPA (Texas Student Privacy Alliance) or the district's own DPA.
Accessibility
DistrictAssist is designed to meet WCAG 2.1 AA.
Certifications
TX-RAMP certification: planned.
Security contact
Manuel Zamorano, Information Security Officer. support@gooddaysource.com · manuel@gooddaysource.com · 504-435-5640
Incident notification: affected districts are notified without unreasonable delay and within the timeframe in their DPA.