The U.S. Department of Education's Privacy Technical Assistance Center (PTAC) recommends written agreements with online service providers and lists provisions to include: security and data stewardship, collection, use and retention, data access, duration and termination, and indemnification and warranty. This is guidance, not legal advice.
Where the list comes from
PTAC's February 2014 document on online educational services says that even when FERPA is not implicated, the Department recommends written agreements as a best practice. It was written about services students use, but the headings work as a checklist for any tool that may hold school data, including developer security tools. Check whether newer guidance has replaced it.
The six provision groups
| Provision group | What PTAC says to settle | Question to ask a security tool vendor |
|---|---|---|
| Security and data stewardship | Who owns the data, each side's duties after a breach, minimum security controls, a right to audit where appropriate | What controls do you run, and what evidence can you share? |
| Collection | Be specific about what is collected, such as forms, logs, cookies, tracking pixels | What does the product send to you, field by field? |
| Use, retention, disclosure, destruction | Limit use to approved purposes, name who data can be shared with, require deletion after the contract | When and how is our data deleted? |
| Data access | Who may access which data and how | Can we export our findings and records? |
| Modification, duration, termination | Term length, how changes are agreed, what happens to data at the end | What changes do you make without notice? |
| Indemnification and warranty | Check what state law allows | Route to your counsel |
How to use this in practice
- Put the six headings in your review template.
- For each, write one sentence on what the tool does today.
- Mark any gap and decide whether to accept it, negotiate it, or pick another tool.
- Attach the filled template to the purchase record.
Two points worth underlining
Collection should be specific. PTAC suggests naming the kinds of data collected. For a scanner, that means asking whether it uploads source code, only dependency names and versions, or only results. The answer changes the risk.
Destruction needs a plan. PTAC suggests including archival and destruction requirements so data is no longer on the provider's systems after the contract period. Ask what that looks like for backups and logs.
What not to do
- Do not treat a signed form as the end. Revisit terms when the vendor updates its product or terms.
- Do not skip review because a tool is free. See should a free scanner go through the same approval as a paid one.
- Do not copy terms from a student facing product without checking they fit a developer tool.
For a shared template, see what is the NDPA.
Quick check
Is a written agreement required by FERPA for every vendor?
PTAC says the Department recommends written agreements as a best practice. Your counsel can advise on what applies to you.
Do these headings fit a code scanner?
Yes as a checklist. Adapt the questions to what the tool actually receives.
Sources
Last reviewed: 19 October 2026.
