IEPVue is operated by Eccleston Education Consulting LLC. This public overview describes the safeguards used to protect account, student, and document information. It is a summary, not a disclosure of confidential security configurations or incident-response procedures.
The short version: We minimize the information we collect, keep source documents in private temporary storage for the requested analysis, restrict access by account and role, protect data in transit and at rest using provider-supported safeguards, and monitor the service without intentionally sending student content into ordinary analytics or error reports. No system can be guaranteed completely secure.
IEPVue maintains a written information-security program appropriate to the size of the business, the nature of the service, and the sensitivity of student information. The program assigns responsibility for safeguards; addresses access, vendors, credentials, monitoring, incident response, retention, and recovery; and is reviewed when the service or risk environment materially changes.
We seek to collect and process only information reasonably necessary to provide the feature a user requests, protect the service, manage the account, and meet legal obligations. Optional profile fields and optional memory are not a license to collect an entire student history. Source documents are not intended to become a permanent hidden archive.
Storage lifecycle deletion can require additional provider processing time. Limited copies may also remain temporarily in protected backups or service-provider security records as described in the Data Retention Policy.
IEPVue requires authentication for protected features. Sensitive operations are designed to recheck the caller's identity, account entitlement, selected student profile, and authority on the server rather than relying only on information displayed in the browser. Records and operations are restricted by account ownership and role. Administrative and testing capabilities are separated from ordinary user capabilities and are not treated as a way to bypass customer-account protections.
Users should never share passwords, authentication links, or one-time codes. If you believe your account has been accessed without permission, contact us promptly and change any reused password with the relevant sign-in provider.
IEPVue uses specialized providers for hosting and authentication, network protection and temporary storage, application data, AI processing, payments, communications, and privacy-filtered reliability monitoring. We evaluate providers in light of the data and service involved and use contracts or platform terms addressing confidentiality, security, and permitted processing where appropriate.
Our current provider categories and relevant data uses are described in the Privacy Policy. A provider's own security or compliance certification does not make IEPVue immune from risk, and we do not represent that a certification held by one provider automatically applies to every part of IEPVue.
AI requests are sent through controlled business integrations rather than consumer chatbot accounts. We do not opt in to using user content to train or improve a provider's general-purpose AI models. No-training treatment does not mean zero retention: a provider may retain inputs and outputs for a limited period for abuse prevention, security, service operation, or legal compliance. See How We Use AI for the complete boundary.
IEPVue uses limited performance, error, and security monitoring to maintain the service and investigate problems. Monitoring controls are designed to exclude source-document text, chat content, report findings, student names, school names, original filenames, authentication secrets, and full request bodies. Session replay is not used on sensitive IEPVue surfaces. When a support issue requires content, the user should provide only the minimum necessary information through the approved support method.
Security-sensitive changes are reviewed and tested before release. Testing includes authorization failures, account separation, direct-call protection, input handling, credit and entitlement controls, privacy-safe logging, and error recovery. Development and test activity uses synthetic or properly authorized materials. Production access and changes are limited to people and systems with an operational need.
IEPVue maintains procedures to identify, contain, investigate, document, and recover from suspected security events. We coordinate with relevant providers and insurers and provide notices required by applicable law. The timing and content of any notice depend on the facts, the information involved, and the governing law; we do not delay a legally required notice merely to complete every aspect of an investigation.
Different records serve different purposes and therefore have different retention periods. Temporary uploads, saved reports, profiles, optional memory, billing records, consent records, support messages, and security logs are not treated as one category. The complete schedule and deletion exceptions appear in the Data Retention Policy.
Reasonable safeguards reduce risk but cannot eliminate it. Internet transmission, software, automated processing, and third-party services can fail or be attacked. This overview may be updated as IEPVue's architecture and safeguards change. We will not describe a security control as active unless it applies to the relevant production service.
Email [email protected] with “Security” in the subject line. Do not include student records, passwords, secret keys, or exploit code in the first message. We will provide a safer channel if additional information is needed.