GradingPal helps teachers assess student work and give useful feedback while providing schools with clear information about how that work is handled. Review the safeguards, published policies, and data agreements your institution needs to evaluate the service.
Student work is not used to train AI models.
GradingPal's published compliance information covers FERPA, COPPA, GDPR and UK GDPR, SOPIPA, and New York Education Law § 2-d. GradingPal is CASA Tier 2 verified. The documents below explain the commitments and processes relevant to your school's review.
FERPA
Compliant
COPPA
Compliant
GDPR
Compliant
CASA
Tier 2 Verified
Teachers provide assignments, criteria, and supported student submissions. GradingPal processes that information to produce rubric-based scores, explanations, and feedback, with assessment evidence supporting relevant classroom insights and standards workflows.
Teachers review the assessment, make changes, and choose what to return. The responsible AI page explains those review controls. The Privacy Notice and applicable data agreement explain the handling of personal and student data.
Student work is not used to train AI models. The published EU/UK Privacy Notice also explains that AI providers processing personal information for the service are contractually prohibited from using it to train their own models. Read the EU/UK Privacy Notice.
GradingPal uses infrastructure and AI providers to deliver the service. The public sub-processor list identifies the providers and their roles so your team can review the processing chain. Review the current sub-processors.
Retention, return, and deletion requirements depend on the applicable account relationship and agreement. Schools can review the Student Data Privacy Addendum and discuss their requirements with the team. For a request about your data, use the contact details in the applicable notice or agreement.
The published Security Plan describes the controls, responsibilities, and processes used to protect student data. These summaries provide a starting point; the linked document contains the detailed provisions.
Student data is encrypted at rest using AES-256 and in transit using TLS 1.2 or higher, as described in the Security Plan. These safeguards cover stored data and data moving between users and the service.
The Security Plan describes access restrictions and privacy and security training for personnel who handle student data. It also sets out processes for granting and removing access.
The Security Plan describes the review of sub-processors and written data protection requirements for providers that access student data. The current public registry gives your school the provider information to inspect.
The Security Plan sets out incident-response responsibilities and the data return and destruction process. Schools should review these provisions with the relevant data agreement when assessing their requirements.
The following documents are publicly available. You can read them without booking a meeting or signing an NDA.
How GradingPal handles personal information and how to contact the company about privacy. Read the Privacy Notice.
The published terms covering student data in the school relationship, including the relevant exhibits and obligations. Read the Student Data Privacy Addendum.
The published data-processing terms for the service. Read the Data Processing Agreement.
The documented security controls, responsibilities, and response processes. Read the Security Plan.
The current service providers involved in processing data and the information published about their roles. Read the Sub-processor List.
Information about processing, transfers, rights, and requests for the EU/UK context. Read the EU/UK Privacy Notice.
The terms governing use of GradingPal. Read the Terms of Use.
Start with the published documents, then tell us the institution name and any agreement or review requirements. Our team can discuss the appropriate data agreement and work from your district's template where possible.
Use the DPA request form and include your institution's details. Tell us if your team has a template or specific questions.
Our published process provides a DPA draft in 1–2 business days. Your legal and IT reviewers can then examine the processing terms, raise questions, and discuss changes with us.
Once the parties agree the terms, the agreement can be countersigned. Your institution determines whether its wider procurement and approval requirements have been met.
Your review may cover the kinds of student work teachers will upload, the LMS connection, account access, retention, and the use of feedback and classroom insights. Tell us which requirements apply so we can point you to the relevant documentation or discuss the proposed setup.
Google Classroom is available now. Canvas and Schoology are available on a school plan. The available integration and the details of your institution's data flow should be considered together. Explore GradingPal for schools.
Teachers evaluating GradingPal can start with their school's approved process, inspect the assessment controls, and share this documentation with the appropriate team. A school's software approval is a separate decision from whether an individual assignment was graded well.
Start with the Student Data Privacy Addendum, Security Plan, and current sub-processor list. Use the Privacy Notice, Data Processing Agreement, and EU/UK Privacy Notice as relevant to your relationship and jurisdiction. All are linked in the document directory above.
Yes. Send your security, privacy, or agreement questions and identify the school or institution. We can discuss the requirements and the relevant published documents. Contact the team.
No. It provides information for that review. Your institution decides whether the service and agreements meet its requirements.
The Security Plan describes AES-256 encryption at rest, TLS 1.2 or higher in transit, access controls, and other operational safeguards. See the complete plan and sub-processor list for the documented service context.
No. Student work is not used to train AI models. The EU/UK Privacy Notice also describes contractual restrictions on training by AI service providers.
Use the current Sub-processor List. The registry is the source for provider details; the number of providers can change as the service changes.
Consult the applicable agreement and privacy notice for the account relationship. Schools can review the Student Data Privacy Addendum and contact the team about return or deletion requirements. This summary does not replace the terms that apply to a particular institution.
For work handled through a school, start with the school contact responsible for the student's information. The applicable privacy notice and student data agreement describe the request process and GradingPal's contact details.
Read the EU/UK Privacy Notice and the relevant data-processing agreement. They describe the published processing, transfer, and rights information. Contact us about requirements specific to your institution.
GradingPal does not currently claim its own SOC 2 certification. CASA Tier 2 verification is a separate assessment. Any certification held by an infrastructure provider applies to that provider and should not be presented as GradingPal's certification.
The published process is a draft in 1–2 business days after the request. The time to review, negotiate, and complete your institution's approval depends on the requirements and the parties involved.
We work from district templates where possible. Include the template or explain the requirement when you contact the team; the parties will need to agree the terms.
The applicable agreement sets out the data return, retention, and destruction requirements. Review those provisions with your school team and contact GradingPal to coordinate the relevant request and process.
Read the public documents, request a data agreement, or send the questions your team needs answered to evaluate GradingPal.