Yes. The U.S. Department of Education's student privacy office recommends that free online services go through the same or a similar approval process as paid ones. A free scanner can still collect data and touch systems. A short, scaled review keeps security staff moving without a backdoor around controls. This is guidance, not legal advice.
What the guidance says
PTAC's document on online educational services states that teachers and staff should not bypass internal controls in the acquisition process when they choose free services. It recommends that free services go through the same or a similar approval as paid ones, so that privacy and security concerns are considered and so that IT can help with testing and rollout. It also notes that simpler, more streamlined processes tend to produce greater compliance.
That last point matters. A heavy process pushes people toward quiet downloads. A light one gets used.
Why free is not the same as low risk
- A free tool still accepts terms of service, and those terms bind your organization.
- It may collect usage data, account details or code.
- It may run on a developer laptop with broad file access.
- It may be gone or change terms next year.
A light review path for a free scanner
| Step | Owner | Time to aim for |
|---|---|---|
| Name the tool, the sponsor and the purpose | Requester | A few minutes |
| List what data the tool receives and where it goes | Requester with IT | One short page |
| Read the terms for change without notice, data use and deletion | IT or privacy lead | A short read |
| Test on a non-sensitive project first | IT | One sprint or less |
| Record the decision and who approved it | IT | A few minutes |
The times are guidance for planning, not a rule. Use what fits your team.
Questions that fit on one page
- Does it upload source code, or only metadata and results?
- Is any student, staff or customer data in the projects being scanned?
- Can it be removed cleanly, with data deleted?
- Can an individual accept the terms alone, or must someone with authority approve?
- What happens if the vendor changes the terms?
PTAC also advises limiting who may accept click-wrap terms, and saving a copy of what was accepted. See who can click accept on a developer tool.
Try it yourself
Click through it at your own pace, or open it full screen. Notice that the output is a list of components and findings, which helps you judge what a scan of a test project would reveal.
Quick check
Is a free tool exempt from procurement review?
No. The Department of Education guidance recommends the same or a similar approval as paid services.
Can the review be short?
Yes. Scale it to the data involved. A one page review with a test on a non-sensitive project is a reasonable start.
Safeguard offers a free scan at gold.safeguard.sh/scan. Whatever tool you use, run it through your own review first.
Sources
Last reviewed: 19 October 2026.
