Classic Test Prep · Trust Center
Student data, handled like it matters
Classic Test Prep is a CLT, SAT and ACT study program used by individual families and by schools. This page is for the people who have to decide whether to trust us with their students: what we collect, what we never do, how we secure it, and what we sign.
Last updated November 12, 2026
Security controls
17 of 30 verified
Subprocessors with student data
4
Advertising to students
None
Student data to AI models
None
The short version for a district reviewer. Statuses on this site are our own self-assessment, updated as items are verified; nothing here has been audited by a third party yet. We sign the SDPC National Data Privacy Agreement with the Florida exhibits. School accounts see no advertising, no pricing and no upsells, and no marketing tag ever loads for them. We collect name, school email, class membership and study results, nothing else. Multi-factor authentication for staff is being switched on before any district data is loaded. Data lives in the United States, encrypted in transit and at rest, with daily backups. We delete on request within 3 days, within 90 days of a student leaving on your notice, and within 60 days of termination with written certification.
Security
Encryption, hosting, access control, application security, and the controls still on the roadmap.
Student privacy
What we collect from students, what we never do with it, FERPA and COPPA roles, Florida 1006.1494.
Data and retention
The full data element inventory (Exhibit B style) and the retention and deletion schedule.
Subprocessors
Every vendor that touches data, what they hold, where, and their own trust pages.
Compliance
The agreements we sign, the laws we operate under, and the certifications we hold or are pursuing.
Policies
Our written security and privacy policies, available to districts on request.
Compliance at a glance
FERPA
CommittedWe commit to operate as a school official under the direct control of each school with respect to education records, to use student data only for the authorized educational purpose, and never to re-disclose it. The designation takes effect in each district's signed agreement.
COPPA
CommittedFor school accounts we rely on the school's consent on behalf of students under 13; the app has no parental consent flow of its own. We collect no more than the service needs and never use student data for commercial purposes.
Florida Statutes 1006.1494 and 1002.22
CommittedWe commit to each operator requirement: no targeted advertising, no profiles for non-educational purposes, no sale or disclosure, reasonable security, and deletion of covered information when the program ends or within 90 days after a student leaves on district notice. No district has yet audited this.
Student Data Privacy Consortium National DPA (Florida)
CommittedWe will sign the SDPC National Data Privacy Agreement with the Florida exhibits on request and offer Exhibit E so any Florida district can adopt the same terms. No Florida NDPA is signed yet.
CISA K-12 Secure by Design Pledge
PlannedThe voluntary CISA pledge for K-12 technology providers (single sign-on and security logs at no extra charge, a vulnerability disclosure policy, a published security roadmap). Signing in progress. The Future of Privacy Forum retired the Student Privacy Pledge in April 2025 and points vendors here and to the SDPC agreement instead.
Accessibility (WCAG 2.1 AA)
In progressThe application is built to WCAG 2.1 AA; a formal conformance report (VPAT) is in progress.
SOC 2 Type II
PlannedNot yet held by Classic Test Prep. Provider reports (Render, Clerk, Stripe, Cloudflare) are available under NDA.