Is it safe to use AI tools with student data?

"They told us it doesn't train on our data."

I've heard that sentence, or something close to it, from people who did their homework. Somebody read the terms and brought back the good news, and the claim can be perfectly true. It's also the smaller of the two questions, which is how a project ends up stopped six weeks before launch by somebody in legal who should have been in the room on day one.

Is it safe to use AI tools with student data? It can be, when three things line up: the vendor's training terms, its retention settings, and your own legal authority to hand the records over. I run production sites through Cloudflare and have used Workers AI for small internal tools, nothing student-facing, so one finding below is about a vendor I use.

Two questions that get answered as one

Whether a vendor trains on your content is a contract term, and the four platforms below give the same answer. Cloudflare says it doesn't use Customer Content to train any model on Workers AI. AWS says Bedrock content isn't used to improve base models and isn't shared with model providers. Microsoft says prompts, completions and embeddings aren't used to train foundation models without your permission and aren't available to OpenAI. OpenAI says API data isn't used for training unless you opt in.

Not training is about what a company does with your content inside its own systems. It says nothing about whether your institution had the authority to disclose education records in the first place.

Whether your district may hand records to that vendor at all is a FERPA question, and no product answers it for you.

What the regulation asks of the vendor

FERPA, the Family Educational Rights and Privacy Act, lets a school share education records with an outside company without consent if that company counts as a school official. Under 34 CFR 99.31(a)(1)(i)(B) it counts if it does three things. It performs a service the school would otherwise use its own employees for. It's under the school's direct control when it uses and maintains the records. And it follows 34 CFR 99.33(a): use the information only for the purpose it was disclosed for, and never pass it on without consent. The school also has to limit access to people with a legitimate educational interest.

In practice that lives in the agreement. If the vendor's paperwork doesn't say who controls the data, what it may be used for, and that it can't be passed on, the exception has nothing holding it up. Your counsel writes that conclusion, and the Department of Education's Student Privacy Policy Office publishes guidance worth reading first.

Beyond FERPA

I know of no FERPA certification for a vendor to hold, and neither section mentions one. Your state may add its own student-privacy statute, so the federal answer is a floor. In Ontario FERPA doesn't apply: the Information and Privacy Commissioner lists school boards under MFIPPA, the Municipal Freedom of Information and Protection of Privacy Act, and colleges and universities under FIPPA.

Where the writing sits after the call

Underneath both questions is a third: where does the content sit once the call is made, and for how long. The office copier seems to forget, but the FTC's guidance notes its hard drive stores data about the documents it handles. A gateway log is the same kind of object, and the defaults differ by product.

Cloudflare AI Gateway: logs on, cache off

AI Gateway is Cloudflare's proxy and observability layer for model calls. Here's the part that belongs in your notes: logs are enabled by default for each gateway. Cloudflare documents a request header, cf-aig-collect-log-payload, that skips payload storage and keeps only metadata such as token counts, model and status code, or collection can be turned off. Retention depends on when the gateway was created. Gateways made before September 24, 2026 use Legacy Logs, which keep logs until you delete them, up to a plan limit. Newer ones follow Workers Logs retention, which Cloudflare lists as 3 days on the Free plan and 7 on Paid. Ask which one your gateway is on.

Caching is disabled by default. Once on, the cache key is a hash of the request, and the response is held for between 60 seconds and one month. For a grading assistant, a response can be an assessment of one named student, so set that time to live on purpose or leave the cache off for that route. The rest of what Cloudflare does in front of a school's LMS is in the DDoS protection post.

Azure OpenAI: two catches

Microsoft's line is that prompts, completions and embeddings aren't available to other customers or to OpenAI. The fear I hear is some version of "we're sending kids' work to OpenAI." With this product, you aren't.

There are two catches. The first is abuse review. It's automated by default, and a person gets involved only when automated review can't reach its confidence thresholds. When that happens, a sample of prompts and completions sits in a store separated by customer, in the Azure geography of your resource. Customers who meet Microsoft's Limited Access criteria can apply to turn that storage and human review off. The second catch is state. Features that keep it, such as the Responses API, Assistants threads and stored completions, persist message history in your own Azure tenant, encrypted and deletable by you. Global and DataZone deployment types can also process prompts outside your geography while data at rest stays put, so ask which type a vendor bought before you tell a board where inference happens.

AWS Bedrock: logging is off until somebody turns it on

Model invocation logging is disabled by default. When it's on, it collects the full request and response for every supported call in that account and Region, to Amazon S3 or CloudWatch Logs, and keeps it until the logging configuration is deleted. A district that never turns it on has no AWS-side record of what was asked. One that does has made a new place student writing sits. Whatever lifecycle or retention settings you put on the S3 bucket or CloudWatch log group apply on top, so set them.

OpenAI's API: 30 days, and the endpoints that never reach zero retention

OpenAI keeps abuse-monitoring logs for up to 30 days, unless law or the protection of its services requires longer. Zero Data Retention is available on eligible endpoints such as chat completions and embeddings. It isn't available on Assistants, threads, vector stores, files or conversations, because those store application state until deleted, and Assistants objects you never delete are retained indefinitely. OpenAI's deprecations page lists the Assistants API for shutdown on August 26, 2026, with the Responses and Conversations APIs as the replacement. I haven't confirmed the shutdown itself has happened. Conversations is on the list above, so a product that moved there is still storing state, and the vendor should be able to say for how long.

Ask whether the endpoint remembers

At a counter the transaction completes and the clerk forgets you. A tab has your name on it and accumulates. A tutoring bot that recalls what a student said last Tuesday is running a tab, and zero-retention approval doesn't reach it, because retention there is the product working correctly. If what's on that tab is a fourteen-year-old's writing about a difficult year at home, the difference stops being technical.

Ask the vendor which endpoints the product calls and whether any are stateful, where that memory lives, how long it stays, and how a district requests deletion for one named student.

Who is on the other end of the call

You vet the contractor and sign the agreement, then a subcontractor you've never met is in the house on Thursday. Some AI-labelled education products are a thin layer over a model provider's API, and the question that matters is which account the call goes out on. A district can vet Azure OpenAI carefully and then buy a tutoring product that calls a different tier underneath, with none of that paperwork extended to it. Ask which model API the product calls, on what account tier, and whether its agreement with that provider carries the same protections.

Start with one request

Pick the AI feature closest to going live and trace one request on paper. Write down which company receives the prompt, on whose account, through which endpoint, held for how long, and under what signed agreement. Then find the written terms, not the sales deck that implies them.

Which question did a vendor take longest to answer the last time you reviewed an AI feature?

If you'd like a second pair of eyes on a vendor's paperwork before it reaches a board, that sits inside my AI operations work, or you can get in touch first.

Checked against Cloudflare's AI Gateway caching, logging, Legacy Logs, Workers Logs and Workers AI data-usage pages, Microsoft's data, privacy and security page for Azure OpenAI and its abuse monitoring page, AWS's Bedrock FAQ and invocation logging page, OpenAI's data controls and deprecations pages, and the FTC's digital copier guide, on 2026-10-11. Regulation text read at the Legal Information Institute: 34 CFR 99.31 and 99.33.

References

1. Amazon Web Services. Amazon Bedrock FAQs.
2. Amazon Web Services. Monitor model invocation using CloudWatch Logs and Amazon S3.
3. Cloudflare. AI Gateway: caching.
4. Cloudflare. AI Gateway: logging.
5. Cloudflare. AI Gateway: Legacy Logs.
6. Cloudflare. Workers Logs.
7. Cloudflare. Workers AI: Cloudflare's use of customer content.
8. Microsoft. Data, privacy, and security for Foundry Models sold by Azure.
9. Microsoft. Foundry Models sold by Azure abuse monitoring.
10. OpenAI. Your data: data controls in the OpenAI platform.
11. OpenAI. Deprecations.
12. U.S. Federal Trade Commission. Digital copier data security: a guide for businesses.
13. U.S. Department of Education. Student Privacy Policy Office.
14. Legal Information Institute. 34 CFR 99.31, Under what conditions is prior consent not required to disclose information?
15. Legal Information Institute. 34 CFR 99.33, Limitations on redisclosure.
16. Information and Privacy Commissioner of Ontario. FIPPA and MFIPPA: privacy for organizations.