EdTech Data Safety & Evidence Label
Select a vendor
Choose a product to review its weighted screening signal.
Vendor representative? Select your product in the list to request access.
Select a product to see its supporting evidence.
The score combines five weighted screening factors.
Rating overview
Review the safety facts and how the five factors contribute to the score.
District review format
Data Safety Facts
Product profileSelect a vendor to see provisional data categories.
Unknown controls lower confidence, not maturity.
Weighted screening model
Vendor risk matrix
These read-only indicators show the current evidence-based factors. Approved vendors can submit supporting evidence through their emailed access link; district reviewers decide what is supported before the published record changes. Try the sample vendor demonstration.
Unknown security controls are neutral and reduce confidence rather than the Safety Score. Verified negative findings create penalties.
Data Sensitivity rating
Show how harmful the exposed data could be.
Six components measure intrinsic sensitivity and controllable exposure. 100 means no data sensitivity risk; higher is better. The weighted risk contribution is (100 − Data Sensitivity Rating) × 30%. Sensitive-purpose products are not treated as careless when they minimize and tightly manage exposure.
Both subscores use 100 as best: intrinsic data safety reflects lower data sensitivity; exposure management reflects narrower collection, retention, identification, and sharing.
Unknown inventory fields are shown as unknown and receive a conservative provisional risk value.
Security Maturity rating
Measure security capability, not just stated compliance.
Seven security domains measure underlying maturity separately from evidence coverage. The risk model converts the positive score using (100 - Security Maturity Score) x 25%. UpGuard supplies external observable evidence for one 10% security subdomain; it does not replace verified internal controls.
No security evidence has been assessed.
Unknown controls use a neutral maturity baseline and reduce evidence coverage. Only verified negative evidence creates a penalty.
Vendor progression ladder
A realistic public-evidence roadmap.
Security and privacy pages, security.txt, contacts, retention and deletion policy, subprocessors, AI-use statement, breach commitment, and a standard DPA.
Trust center, MFA and encryption summaries, vulnerability disclosure, penetration-test summary, continuity, secure-development, and incident-response overviews.
SOC 2 or ISO where feasible, current penetration testing, formal risk management, third-party posture signals, and auditable deletion controls.
SOC 2 and ISO raise confidence but are not the only route to a strong rating. Technical documentation, verified controls, credible attestations, and observable evidence can also support maturity.
Authoritative starting points
Security source library
Compliance rating
Score the quality, scope, and currency of K-12 evidence.
Compliance measures known contract and control quality. Unverified items remain neutral; reviewed positive or negative evidence changes the score. The risk model converts it using (100 - Compliance Score) x 20%.
Public references are starting evidence, not proof that the district's product and contract are in scope.
Vendor transparency rating
See the evidence behind the score.
Evidence points reward information that is available for review. Transparency risk is calculated as 100 minus evidence points, then contributes 15% of the composite vendor risk score. UpGuard can corroborate external observations but does not replace vendor-published transparency evidence.
Vendor-submitted evidence remains provisional until a district reviewer verifies it.
Incident History rating
Document events, context, and response quality.
Higher incident-history ratings are better. The rating is 100 minus incident risk, based on verified events and reviewed sources. UpGuard changes may create a review lead, but authoritative notices and corroborated records determine this score. Each event is scored for severity, scope, affected data, root cause, response, regulatory action, repeat history, and recency before contributing 10% of composite vendor risk.
Unassessed history is neutral at 50.
0 of 5 source groups reviewed
No incident records have been added for this vendor.
Official starting points
Incident source library
What supports this label
Evidence register
Select a vendor to inspect evidence and gaps.