*Note: This post is a companion to our earlier piece on states leading in student data privacy.
Interested in learning more about SDPC vendor membership? CLICK HERE to find out more.
When people think about student data privacy, the conversation often centers on schools, districts, and state agencies working to protect students. But some of the most committed champions of student data privacy are the vendors who build the tools students and teachers use every day. These companies, many of them quietly doing exceptional work, have made privacy a core value, not an afterthought.
Over the past several months, we had the opportunity to sit down with leaders from eight SDPC vendor member companies. They ranged from small startups to large publishers, from US-based companies to international ones, from platforms used in a handful of states to tools found in the majority of American schools. What struck us most was how consistent their commitment was, and how clearly they articulated the ways SDPC membership has amplified that commitment.
Their stories add up to something important: a picture of a vendor community that isn’t just complying with student data privacy requirements, but actively leading on them.
A Shared Foundation: Privacy Isn’t Compliance, It’s Character
Before diving into individual spotlights, it’s worth pausing on something that came through in nearly every conversation: for these companies, privacy isn’t a legal checkbox. It’s part of how they think about their products, their customers, and their responsibilities.
Cengage’s Senior Privacy Counsel Desarie Green put it plainly:
“Privacy can be a business driver. It’s data that needs to be protected and our customers care about it. When we can show our commitment to privacy, it puts our customers at ease. Don’t look at it as a compliance issue, but a business issue that builds customer trust.”
Savvas Chief Privacy Officer Ryan Johnson described his company as stewards of the data they hold:
“We only collect the data needed to deliver our products. We are not interested in monetizing the data, and never will be.”
This kind of values-first framing came up again and again. These aren’t companies that arrived at privacy because regulators forced them there. They arrived because they understood what was at stake.
The Vendor Spotlights
Boom Learning: Privacy by Design, From the Very Beginning
When Mary Oemig founded Boom Learning in 2015, she didn’t have a dedicated privacy team. What she had was a clear philosophy, shaped by her background as an attorney and her experience as a parent of a child with learning differences: collect only the data you need, give schools control over how that data is used, and make sure every student is connected to an identifiable adult.
Those principles are baked into the product’s architecture. Student accounts at Boom Learning can’t exist independently of a teacher account, a design choice that prevents children from creating accounts on their own or forming relationships with strangers online. Schools and teachers choose how to assign usernames, which means student names don’t have to be stored at all. The result is a platform so privacy-conscious it’s even used in medical settings.
Boom Learning had about 2.5 employees when SDPC version 1.0 contracts started arriving in 2019. Oemig recognized immediately that the NDPA was a well-constructed agreement. As the company grew, eventually reaching 28 people, SDPC membership became foundational to how they managed their privacy obligations.
“I could create a straightforward playbook for my paralegal on how to handle agreements,” Oemig explained. “We ask for no changes to the standard terms of NDPA 2.0, and the paralegal can spot issues quickly because the agreements are standard. We can do this with just a paralegal, not a full-time lawyer.”
For Oemig, the NDPA also functions as something of an orientation guide, especially for vendors who are new to selling into schools. “If you’re new to the space, it’s an education on what you need to be taking care of,” she said. “For a vendor coming from a direct-to-parent market who wants to enter the school market, it gives you a checklist of what the issues are going to be.”
Cengage: Privacy and the Promise of Personalized Learning
Cengage Learning, Inc. is one of the largest educational content companies in the country, serving thousands of institutional customers and navigating an increasingly complex patchwork of state and federal privacy regulations. When they joined us for a conversation — including Director of Legal Operations Christina Ciaramella, Senior Privacy Counsel Desarie Green, and outside counsel Leah Druckerman — they brought a perspective shaped by scale.
One of the things Cengage most values about SDPC is its work educating districts about their own obligations. “A big challenge for us has been helping districts understand what their obligations are,” Green said. “Many districts aren’t even aware of how COPPA (Children’s Online Privacy Protection Act) consent requirements work for educational content vendors like Cengage. We appreciate that there is an organization focused on educating districts, because when districts know more about their obligations, it benefits vendors too.”
Cengage also raised a forward-looking challenge that echoes across the industry: the intersection of privacy and artificial intelligence. As Cengage works to embed personalization and AI into its platforms, the current NDPA framework leaves some questions unaddressed. These are questions that districts have been filling in with their own addenda, creating friction and inconsistency. Cengage sees SDPC as the right venue for working through these issues collaboratively. “We want to have these conversations with the consortia,” Green said, “because this is the direction that ed tech is going.”
Their encouragement to other vendors is direct:
“Don’t look at privacy as a compliance issue. Look at it as a business issue that builds customer trust, and recognize that having a seat at the table really matters.”
Savvas: Managing Privacy at Scale
When Savvas was divested from Pearson in 2019, Ryan Johnson was brought in with a singular focus: managing the company’s privacy landscape. His role as VP, Associate General Counsel, and Chief Privacy Officer isn’t shared with other duties. That, he says, reflects something important about how seriously Savvas takes the trust schools place in them.
“We are stewards of the data,” Johnson said. “Meeting contractual and regulatory compliance, collecting only the data needed to deliver our products, that’s the foundation.”
With more than 3,000 institutional customers, managing privacy at scale is both a challenge and a necessity. SDPC has been central to meeting that challenge. “We wouldn’t have the capacity to negotiate every single agreement if it weren’t for SDPC,” Johnson said.
Savvas has been involved with SDPC since the beginning, not just as a consumer of the NDPA, but as a contributor to it. “We really felt the SDPC mission was a sound one right from the start,” Johnson said. “We wanted to be a part of guiding the work, to make sure it was practical to implement operationally while still meeting rigorous privacy requirements.” Over time, they began to see their own redlines show up in the agreement, a sign that their voice at the table was making a difference.
He also highlighted the registry’s automated Exhibit E signing process as a transformative operational tool:
“The automated process of signing on to the Exhibit E has been tremendous.”
ClassLink: Reducing Systemic Risk across the Edtech Ecosystem
Patrick Devanney, Senior Vice President of Strategy and Partnerships at ClassLink, comes at data privacy from a distinctive angle. ClassLink is a platform that makes technology adoption easier for schools. This means, as Devanny puts it, that if that isn’t done properly, “it can cause exposure and endanger privacy, because tech is an amplifier.”
ClassLink has been a long-time SDPC supporter, with Devanney serving on the board. The company’s approach to privacy and security extends well beyond its own product. ClassLink, as a member of the Cybersecurity Coalition for Education, has developed a NIST-based cybersecurity rubric that it gives away to districts. It requires its own vendor partners to sign a privacy MOU, and sweetens the deal with co-marketing opportunities and access to ClassLink events for those who do.
Perhaps most tellingly, ClassLink is working to integrate SDPC registry data into its own platform so that vendors’ DPA status can be automatically verified, rather than self-reported. “The only thing they need to look at is redlines, if there are any,” Devanney said of the SDPC agreement process. “It shortens the sales cycle and allows us to minimize exceptions to the rule, and these exceptions are where failures are most likely to occur. SDPC isn’t just streamlining procurement. It’s risk reduction.”
Devanney framed student data privacy as central to the future of ed tech. With schools facing increased scrutiny around screen time, AI, and technology’s role in learning, he argued that vendors need proven, systemic privacy solutions that build trust. In that sense, privacy is not only a compliance issue. It is a foundation for sustaining confidence in the responsible use of technology in education.
NetSupport: A Global Perspective on Local Privacy
NetSupport is a UK-based company whose products, including classroom management tools that allow teachers to monitor student devices, sit squarely at the intersection of technology and student privacy. Tony Sheppard, who leads information governance, understands better than most why that intersection demands care.
“It’s important to give teachers the right tools in the classroom,” Sheppard said, “but it’s also important that students aren’t seen as being ‘spied on.’ So the privacy and data protection assurance around our products is hugely important, both in the user experience and in the underlying supply chain management.”
In the international market, ISO 27001 is NetSupport’s standard of choice for communicating their commitment. In the US, things are more fragmented, and that’s where SDPC has proven invaluable. “The NDPA has been very helpful in understanding what aspects of agreements are key in the US market,” Sheppard said. SDPC membership has also given NetSupport access to a community of peers: other vendors, districts, and alliances who help keep them current on a rapidly evolving landscape.
NetSupport is also actively contributing to SDPC’s Global Education Security Standard (GESS), a framework designed to establish a common, high-level expectation around data security that can transcend individual national standards. “Yes, GESS creates additional work at first,” Sheppard acknowledged, “but it’s about leading; helping to move the industry toward commonality and a universally high level of expectation around data security.”
Their message to other vendors, particularly international ones considering the US market: SDPC membership helps you sell more easily into the US, understand what districts need, and build credibility around your commitment to privacy. “It gives you a sense of community,” Sheppard said, “and a path to common agreement with districts, alliances, and other vendors.”
Edpuzzle: The NDPA as a Global Model
Miguel Martinez Hernando, Edpuzzle’s Data Protection Officer, knows privacy regulations from a global vantage point. Edpuzzle operates across borders, subject to GDPR in Europe, FERPA and COPPA in the US, and a rapidly evolving landscape of state-level AI laws. The patchwork is, in his words, complex and resource-intensive to navigate.
Which is exactly why he values the NDPA so deeply. “In the US, there are so many unique state regulations,” he said. “The NDPA creates a baseline agreement that makes it clear to schools how we handle privacy and student data. Once you work with NDPA and get it to reflect how you handle privacy, you can re-use that work with every district that participates in the framework.”
The time savings are real. “One of the first things we do is check whether a district participates in the SDPC, either by asking directly or reviewing the SDPC registry,” Martinez Hernando said. “SDPC has reduced the time we dedicate to negotiating privacy agreements significantly.”
But SDPC membership isn’t just an operational convenience for Edpuzzle, it’s a market signal. “Having the ‘SDPC badge’ helps how you present yourself to school districts,” he said. “It expands your market reach, since SDPC has such widespread district membership. And when NDPAs are negotiated with an alliance, you’re typically working with experienced counsel representing multiple districts, which speeds up the process and makes for a stronger agreement.”
“Most of us at Edpuzzle are teachers and parents,” Martinez Hernando noted, and that shapes how they think about student data. “We continually review our privacy practices, work with iKeepSafe and other trusted privacy and security organizations , and don’t just focus on complying with regulation. We focus on making sure we are doing the right thing for students and teachers.”
Khan Academy: Assurance at Scale
Khan Academy occupies an unusual position in the ed tech landscape. It’s one of the few platforms used simultaneously in formal school settings, with district data sharing agreements and compliance obligations, and directly by students and families at home. That dual nature creates privacy complexities that most vendors don’t face.
Jason Hovey, who leads partnerships at Khan Academy, and Diana Olin, Associate General Counsel, have spent years navigating those complexities. For them, SDPC has been a key partner in bringing their school-facing work up to the rigorous standard their product demands.
“Negotiating privacy with a tech consortium gives you ‘assurance at scale,’ quickly,” Olin said. Khan Academy’s experience working with CITE in California is illustrative: a single negotiation with the consortium became scalable across the entire consortium’s membership, and the work they did in one state proved transferable to others. “We can serve so many more people because Khan Academy is able to come in with the trusted A4L/SDPC brand alongside us,” Olin added. “Districts know they can rely on it, our SDPC DPAs, our SOC report.”
Olin was also candid about what SDPC membership should mean for a vendor: “It was important that we really adopted the requirements in the agreement and made sure we could follow them, not just a click-through.” That kind of commitment to the substance of the agreement, not just its execution, is what makes the difference between privacy as performance and privacy as practice.
GoTeacher: Privacy Compliance as a Product
Dean Celaj, Founder and CEO of GoTeacher, began his work in education by building Akademi.al, an online tutoring application for Albanian-speaking students. During COVID, the platform was used daily by 91% of students in Albania. Through that experience, he became increasingly interested in how to measure the actual impact of technology on student outcomes. What he found when he looked at the U.S. market was a privacy gap that ultimately reoriented his company.
“Many school districts are navigating compliance with limited time, resources, and visibility,” he said. “Schools are overwhelmed and don’t have the staff to manage this effectively. We thought we could use AI to help.”
GoTeacher now offers a suite of tools that help districts understand which apps they’re using, whether those apps have DPAs, and how vendors are actually accessing student data. The SDPC registry is an important partner in this work. GoTeacher reads directly from the registry to surface compliance information for districts, including whether each vendor has a signed agreement.
SDPC membership has also simplified GoTeacher’s own path to district partnerships. “SDPC made it easier to get agreements with school districts around the country,” Celaj said. “And having a DPA helps GoTeacher feel more confident in its work with a district, because we know the district is taking privacy seriously too.”
For Celaj, the registry isn’t just a database. It’s a foundation for a more accountable ed tech ecosystem, where privacy obligations are more visible, verifiable, and actionable.
What These Vendors Tell Us About SDPC Membership
Across eight conversations with companies of vastly different sizes, business models, and geographies, five consistent themes emerged, themes that together make the case for what SDPC vendor membership offers:
Privacy by design is possible, and it pays off. Multiple vendors described building privacy into their products from the ground up, not retrofitting it later. Boom Learning’s architecture, Khan Academy’s policy-building process, and an across-the-board founding orientation all reflect a belief that privacy is most effective when it’s structural. And in every case, that orientation helped vendors earn the trust of districts and grow their business.
The NDPA is a game-changer for operational efficiency. For vendors managing dozens, hundreds, or thousands of district relationships, the NDPA is the difference between a manageable legal workflow and an impossible one. Whether it’s Boom Learning’s paralegal playbook, Savvas’s ability to serve 3,000 customers without a bloated legal team, or the thousands of saved hours across all vendors the story is the same: the NDPA doesn’t just protect students. It makes business possible at scale.
The registry is an underrated business tool. Vendors consistently pointed to the registry, and particularly the automated Exhibit E process, as transformative. It provides visibility into district relationships, accelerates the sales cycle, and creates a single source of truth for compliance. GoTeacher has built its entire product on registry data. Savvas calls the automated signing process “tremendous.” ClassLink is working to integrate registry verification directly into its platform.
A seat at the table matters. One of the most consistent themes was the value vendors placed on being part of the process: not just using the agreements, but shaping them. Boom Learning’s Mary Oemig brought her attorney’s perspective to the transition from NDPA 1.0 to 2.0. Savvas watched its own redlines become part of the standard agreement. Multiple vendors expressed interest in joining or deepening their involvement in SDPC committees. The ability to influence the agreements they live by isn’t a perk of membership; for many of these companies, it’s the point.
Privacy is a competitive differentiator. The “SDPC badge,” as EdPuzzle calls it, is real. It signals to districts that a vendor has been vetted, that they take privacy seriously, and that working with them will be simpler than working with vendors who aren’t members. In a market where district procurement teams are stretched thin, that signal matters.
A Community Worth Joining
What comes through most clearly in these conversations is that SDPC vendor membership isn’t just a service, it’s a community. A community of vendors who believe that protecting student data is both a responsibility and a strategic advantage. A community that has a voice in shaping the agreements that govern the industry. A community that is actively working to make privacy easier, more consistent, and more meaningful for districts and vendors alike.
If you’re a vendor who isn’t yet a member, these eight companies have a message for you. In the words of Edpuzzle’s Miguel Martinez Hernando:
“If you are working with US school districts, it’s important to understand what SDPC is and how it can simplify and strengthen your privacy process.”
We couldn’t agree more.
Interested in learning more about SDPC vendor membership?