Hi — we’re evaluating Netlify to host an education platform (DIG) for K-5 teachers, and I submitted written compliance questions through your week ago with no response yet. Posting here in case it helps get this in front of the right team.
The short version: our app is used by teachers (adults) who enter limited student education records — first/last name, grade, and assessment scores — under FERPA’s school-official framework. Students never interact with Netlify directly. I’ve already reviewed your DPA and Trust Center documentation, which was helpful, but I have two specific open questions:
- Does Netlify commit to keeping the primary database, backups, and all stored copies within a single US region we select, or could data be processed elsewhere under some circumstances?
- Exhibit II of your DPA (Technical and Organizational Security Measures) is titled “Enterprise Services” — do those specific commitments apply to a self-serve Pro plan customer, or only to Enterprise contracts?
Would appreciate a pointer to whoever can give a direct written answer, since this is a compliance question our legal counsel is waiting on, not a technical support issue. Happy to move to email if that’s easier — just wanted to flag it publicly since the private request has gone quiet.
Thanks,
Kari