New York Education Law § 2-d requires every district to publish a Parents’ Bill of Rights and requires each vendor contract to include supplemental information. This page provides both: Athena’s statement of the parent rights, and the supplemental information a district attaches to the Athena contract. Districts outside New York can use it as-is; the rights it states are FERPA rights that apply everywhere.
Districts: Part B is a contract template. Replace the bracketed fields with your district’s details before signing.
Part A — Parents’ Bill of Rights
Athena Security, as a third-party contractor to your school district, affirms the following rights of parents, legal guardians, and eligible students:
- A student’s personally identifiable information cannot be sold or released for any commercial purpose.
- Parents have the right to inspect and review the complete contents of their child’s education record. Your school can grant you access to audit logs and reports about your student directly in the Athena platform, or provide them to you on request.
- State and federal laws protect the confidentiality of personally identifiable information, and safeguards associated with industry standards and best practices, including encryption, firewalls, and password protection, must be in place when data is stored or transferred.
- A complete list of all student data elements collected by the State is available for public review at the New York State Education Department (nysed.gov/student-support-services/ferpahipaa), or by writing to the Office of Information and Reporting Services, New York State Education Department, Room 863 EBA, 89 Washington Avenue, Albany, NY 12234.
- Parents have the right to have complaints about possible breaches of student data addressed. Complaints should be directed to your school district at [district privacy officer contact], and may also be directed to the New York State Education Department Chief Privacy Officer at [email protected] or 89 Washington Avenue, Albany, NY 12234.
Part B — Supplemental information for the Athena Security contract
1. Exclusive purpose. Athena receives student data solely to provide the weapons detection and incident documentation services described in its agreement with the district. Student data enters the system only when district staff create an incident record. Athena does not integrate with the district’s student information system or rosters.
2. Subcontractors. Athena’s subcontractors that may receive student data, with the purpose and location of each, are published at athena-security.com/compliance/subprocessors and are incorporated into this contract by reference. Each is bound by written agreement to maintain the confidentiality and security of student data consistent with this contract and Education Law § 2-d. Athena will give the district at least 30 days’ notice before adding or replacing a subcontractor that receives student data.
3. Contract term and data disposition. The agreement runs from [start date] to [end date]. At expiration or termination, Athena will delete all district data within 30 days of the district’s written request, submitted through a support ticket, and certify deletion in writing. Backups are purged within 30 days of deletion.
4. Challenging accuracy. A parent or eligible student who wishes to challenge the accuracy of student data held in the Athena platform should contact the district at [district privacy officer contact]. The district can correct any record directly in the platform, or request correction or deletion by Athena through a support ticket.
5. Storage and security. Student data is stored on AWS and Linode infrastructure in the United States, encrypted in transit and at rest. Alert images are additionally encrypted on the screening device with keys held only on that device and cannot be decrypted by Athena. All access requires two-factor authentication and is logged; the district can view all audit logs. Athena’s security program is audited annually under SOC 2 Type II and aligns with the NIST Cybersecurity Framework as required by 8 NYCRR § 121.5.
6. Encryption. Athena encrypts student data in motion using TLS 1.3 and at rest using AES-256, meeting the encryption standard of Education Law § 2-d(5)(f)(5).
7. Breach notification. Athena will notify the district of any breach or unauthorized release of student data within 72 hours of discovery, which is within the 7-calendar-day requirement of Education Law § 2-d(6). Athena will reimburse the district for the cost of notifications the district is required to make as a result of a breach caused by Athena, up to the amount stated in the sales contract.
8. Training. All Athena employees and contractors with access to student data receive training on federal and state laws governing confidentiality of student data before access is granted and annually thereafter.
Signed for Athena Security: ____________________ Title: ____________________ Date: __________