Skip to main content

FERPA & Student Privacy

Education Savings Accounts (ESA) and Student Scholarship Organizations (SSO) administer public and philanthropic funds for minor K-12 students. Receipts and reimbursement documentation frequently contain Personally Identifiable Information (PII), such as child names, home addresses, diagnoses, and medical/therapy records.

HeyPeppy was architected from day one to comply with the Family Educational Rights and Privacy Act (FERPA) and state student data privacy statutes.

1. Ephemeral Receipt Storage & Auto-Deletion​

  • In-Memory Processing: When tenant platforms provide pre-signed temporary URLs (e.g. from AWS S3, Google Cloud Storage, or Azure Blob Storage), HeyPeppy downloads the document into ephemeral memory buffers for OCR and AI analysis without storing raw documents on disk.
  • Automated Lifecycle Expiration: If files are uploaded directly to HeyPeppy's ingest buckets, a Google Cloud Storage Object Lifecycle Rule automatically and permanently deletes the raw files after 14 to 30 days (configurable per partner tenant agreement).

2. Zero AI Model Training​

  • HeyPeppy utilizes enterprise OpenAI and Google Cloud Vertex AI agreements that explicitly contractually guarantee:
    1. Customer data is never used to train or fine-tune any foundational or public AI models.
    2. Data is encrypted in transit (TLS 1.3) and at rest (AES-256).
    3. Strict SOC-2 Type II and HIPAA/FERPA compliant enterprise processing environments.

3. Data Minimization & Redaction​

  • HeyPeppy's Vision models extract only data fields necessary for reimbursement compliance:
    • Vendor name
    • Date
    • Financial amounts
    • Item descriptions
    • Payment proof indications (last 4 digits only; full credit card numbers are strictly filtered)
    • Student candidate match mapping
  • Medical diagnostic details, full account numbers, and unneeded parent PII are explicitly omitted from final JSON payloads.