Privacy & security
Ownership & control of your student data
Ownership & control of your student data
Because our data storage practices comply with data retention laws, and our Privacy Policy is governed by FERPA, PIPEDA, GDPR and all established federal, regional, and international regulations, Xello customers can rest assured their data will never be accessed or used in unauthorized ways.
Assurance of safe data storage
-
Family Educational Rights and Privacy Act Regulations (FERPA)
-
General Data Protection Regulation (GDPR)
-
Children’s Online Privacy Protection Act (COPPA)
-
Personal Information Protection and Electronic Documents Act (PIPEDA)
-
Education Law Section 2-D (EdLaw 2D)
Assurance of data privacy
Assurance of data privacy
1EdTech Certified Data Privacy is a vetting and certification process used by the educational technology (edtech) consortium 1EdTech to verify that a product or application meets a high standard for data privacy. The certification is a public-facing indicator that an edtech supplier is committed to maintaining privacy standards.
Access 4 Learning community member
Access 4 Learning community member
Composed of more than 3,000 schools, districts, local authorities, states, US and International Ministries of Education, software vendors and consultants, this non-profit collaboration addresses all aspects of information management and access to support learning.
Xello’s commitment
Xello is accessible by all students, educators, and their communities, while maintaining the highest standards of privacy, security and data protection.
Here's how we do it:
-
Secure software development – This includes integrating vulnerability scanning, as early as the development phase, and regular testing.
-
Secure infrastructure – Xello leverages modern technologies such as web application firewalls, intrusion detection and prevention systems to protecting all systems.
-
Data privacy & residency – We take the utmost care to ensure data privacy is maintained, including a commitment to:
- Not selling, sharing or leveraging data for any purpose other than the provision of our services.
- Ensuring data stays in the country of its origin.
- A zero trust approach to who can access client data, with multiple layers of encryption.
3rd party audits
-
SOC2 Type 2 - An annual assessment measuring compliance with various controls in relations to security, confidentiality and availability.
-
CyberEssentials - An annual assessment measuring compliance to the standards developed by IASME and the National Cyber Security Centre.