Classic Test Prep · Trust Center
Agreements, laws, and certifications
What we sign, what we operate under, and where we stand on formal attestations. Where a status says planned, it is planned, not spun.
Last updated November 12, 2026
- Committed
We commit to operate as a school official under the direct control of each school with respect to education records, to use student data only for the authorized educational purpose, and never to re-disclose it. The designation takes effect in each district's signed agreement.
- Committed
For school accounts we rely on the school's consent on behalf of students under 13; the app has no parental consent flow of its own. We collect no more than the service needs and never use student data for commercial purposes.
Florida Statutes 1006.1494 and 1002.22
CommittedWe commit to each operator requirement: no targeted advertising, no profiles for non-educational purposes, no sale or disclosure, reasonable security, and deletion of covered information when the program ends or within 90 days after a student leaves on district notice. No district has yet audited this.
Student Data Privacy Consortium National DPA (Florida)
CommittedWe will sign the SDPC National Data Privacy Agreement with the Florida exhibits on request and offer Exhibit E so any Florida district can adopt the same terms. No Florida NDPA is signed yet.
CISA K-12 Secure by Design Pledge
PlannedThe voluntary CISA pledge for K-12 technology providers (single sign-on and security logs at no extra charge, a vulnerability disclosure policy, a published security roadmap). Signing in progress. The Future of Privacy Forum retired the Student Privacy Pledge in April 2025 and points vendors here and to the SDPC agreement instead.
- In progress
The application is built to WCAG 2.1 AA; a formal conformance report (VPAT) is in progress.
- Planned
Not yet held by Classic Test Prep. Provider reports (Render, Clerk, Stripe, Cloudflare) are available under NDA.
The data privacy agreement
Florida districts use the Student Data Privacy Consortium's National Data Privacy Agreement with the Florida exhibits. We sign it as written. We complete Exhibit B (the data inventory on our data page), Attachment 4 (our security program, our named security coordinator, and our subprocessor list), and we sign Exhibit E, the general offer of terms, so any other Florida district can adopt the same agreement by signing Exhibit E alone. If your district uses its own agreement instead, send it to security@classictestprep.com.
Questionnaires and documents we provide
- HECVAT Lite, completed, on request.
- Our written policies (see Policies), the current risk assessment, and the incident response plan, on request under NDA.
- SOC 2 Type II reports from our hosting (Render), identity (Clerk), payments (Stripe) and storage (Cloudflare) providers, on request under their NDAs.
- A signed certification of destruction at the end of any agreement.