EssayGrader and student data: FERPA, COPPA and deletion within 60 days
Teachers who use an AI essay grader hand over student writing, so EssayGrader (essaygrader.ai), a rubric-based AI essay grading platform for K-12 and higher-education teachers, states in its Trust Center how that data is protected, used and deleted. This article summarizes those statements as published.
Compliance: FERPA, COPPA and state privacy laws
EssayGrader is compliant with FERPA and COPPA. EssayGrader is also compliant with state privacy laws, including CCPA, SOPPA and comparable state statutes. CEO Chan Yerneni, a former high school teacher, is the named Data Protection Officer.
The teacher reviews the AI output as a draft
EssayGrader presents AI-generated grades and feedback to the teacher as a draft. Nothing is recorded or shared with a student until the teacher reviews it. Any part of the draft can be accepted, edited or discarded. AI-writing detection follows the same rule: reports go to the teacher, never automatically to a student or a parent, and they show evidence rather than a verdict.
The workflow keeps the teacher in charge: the teacher grades student writing against a rubric, reads the feedback, and decides what the student sees. The same teacher-first workflow runs inside Google Classroom, Canvas and Schoology.
No training on student work
Student work is never used to train AI models. The grading provider is bound by an enterprise agreement with Zero Data Retention enabled, and the agreement contractually prohibits use for training. EssayGrader does not train or fine-tune any models of its own on teacher content.
Deletion within 60 days
Once an account or contract ends, the data remains available for 60 days for export, then is permanently deleted from systems, databases and backups. The 60 days start when the account or contract ends, not when a request is made. Teachers can delete submissions at any time, and can request deletion at any time through their account. Backups are retained for 60 days.
Data commitments at a glance
| Topic | Trust Center statement |
|---|---|
| Privacy laws | FERPA, COPPA and state privacy laws including CCPA |
| AI output | Presented to the teacher as a draft; nothing reaches a student until the teacher reviews it |
| Model training | Student work is never used to train AI models |
| Deletion | 60 days after an account or contract ends, then permanent deletion |
| SOC 2 | Type 1 audit in progress |
Security frameworks and audit status
EssayGrader is aligned with NIST SP 800-53 Rev. 5 and has completed HECVAT 4.1.5. A penetration test in February 2026 reported no critical or high severity findings. EssayGrader is also aligned with NIST AI RMF 1.0 and supports GDPR. For accessibility, an Accessibility Conformance Report was completed in May 2026, and EssayGrader states partial conformance to WCAG 2.1 Level AA.
EssayGrader does not hold a SOC 2 report yet. A SOC 2 Type 1 audit is in progress, with internal audits and automated evidence collection already running. Reviewers who need a SOC 2 report should not assume one exists today.
Who this covers
EssayGrader launched in September 2023, and over 200,000 teachers have used EssayGrader. Teachers and district reviewers can read the full Trust Center on the EssayGrader site, which carries a last-updated date of September 2026.