FERPA Position & Data-Use Model
INTERNAL DRAFT — no counsel engaged. This reflects the team's intended position and is grounded in the system as built. It is not a legal opinion. Binding contractual language is marked
[LEGAL PLACEHOLDER]and must be finalized by an attorney before it appears in a signed agreement. The factual / technical content below stands on its own and can be shared with a pilot partner as Eli's stated posture.
Last reviewed: 2026-07-12.
Eli's role under FERPA
Eli is intended to operate under an institution's school-official designation, with a legitimate educational interest and under the institution's direct control (FERPA, 34 CFR 99.31(a)(1)(i)(B)). Product design alone does not create that designation or establish FERPA compliance. The institution must make the designation in its annual notice or other applicable policy and execute counsel-reviewed contractual terms before Eli processes education records. The institution's aid office remains the decision-of-record on every case.
The canonical current-state framing is in
../inputs/decisions.md: intended role, institution designation, and counsel-reviewed agreement required.
The "school official" exception lets an institution disclose education records, without prior consent, to a contractor performing an institutional service for which the school would otherwise use its own employees, provided the contractor:
- performs an institutional service or function (verification support);
- is under the direct control of the institution with respect to the use and maintenance of education records;
- uses the records only for the authorized purpose; and
- does not redisclose them without authorization.
Eli is designed to support each condition; the institution and counsel must confirm that the final contract, configuration, and actual operations do so.
Design evidence and the remaining institutional/contract gate
The table describes product design and repository evidence. It does not establish that an institution has made the school-official determination, that direct control exists in an executed agreement, or that deployed controls operate as described.
| FERPA condition | Design/evidence and remaining gate |
|---|---|
| Institutional service the school would otherwise staff | Eli is designed to assist financial-aid operations the institution would otherwise perform. The order form must name the exact SOR, R2T4, SAP, reporting, or other function and its evaluation/operational boundary. |
| Direct control over use/maintenance of records | The design exposes institution configuration and named human review. The institution remains intended records custodian and decision-of-record. Executed direct-control terms, production authorization, and actual operating procedures remain required. |
| Use limited to the authorized purpose | Repository controls scope broad-product access by institution and keep Beta2 sessions/capabilities separate. The signed agreement, exact deployment data flow, role matrix, and deployed negative-access evidence must limit the authorized purpose in practice. |
| No unauthorized redisclosure | Draft policy/DPA terms prohibit sale, secondary use, and model training on Institution Data. Candidate Subprocessors are inventoried, but active-provider terms, data exposure, and due-diligence/flow-down evidence remain pre-production gates (../00-overview/ai-governance-memo.md). |
| Audit of access and change | Review actions and agent runs are hash-chained (lib/audit-hash.ts); general record-read/access and security-event logging remains a production gap |
Data-use model
- Purpose limitation (required target). The order form and DPA must limit use to the named financial-aid function for the institution that provided the data; product design alone is not the binding limitation.
- Least privilege & tenancy (repository evidence). Broad-product authorization code scopes cases by institution and negative-access behavior is tested; retain the deployed role/policy matrix and test evidence for the assessed release (
../02-security/rbac-model.md). - No secondary use (draft commitment). Proposed terms prohibit advertising, resale, model training, and other secondary use of Institution Data. Confirm matching terms and runtime/log behavior for every active provider.
- Retention (policy plus gaps). See
../02-security/data-retention-deletion.md. Record-specific Title IV clocks and contract-end return/destruction are target requirements; production multi-store purge, backup handling, and evidence are not implemented end to end. - Logging. Workflow review actions and agent runs are auditable per case; general record-read/access logging is not yet implemented.
Relationship to the other regulatory docs
FERPA governs the privacy of education records. Two adjacent regimes are addressed separately, using the same role description:
- Third-party servicer status under the Title IV rules:
../04-regulatory/third-party-servicer.md. - Federal Tax Information (FTI) safeguarding when FA-DDX/transcript data is in the flow:
../04-regulatory/fti-fa-ddx-boundaries.md.
[LEGAL PLACEHOLDER] — for the pilot agreement / DPA
The school-official designation and direct-control language must be written into the institution's contract or data-processing agreement to be effective. Draft internally now; an attorney finalizes the binding clause when counsel is engaged.