Effective date: 18 September 2026. Applies to: Apollo 500 weapons detection system, AI X-ray A Series and C Series, Athena Compliance Platform, and Athena’s Weapons Detection System Alert App (together, the “Services”) when used by a K-12 school, district, or other educational agency (a “School”).
1. Purpose and scope
This policy describes how Athena Security (“Athena”) collects, uses, protects, retains, and deletes data that may identify a student when a School uses the Services. It applies in addition to Athena’s general Privacy Policy and the Data Privacy Agreement signed with each School. If this policy and a signed Data Privacy Agreement conflict, the signed agreement controls.
2. Athena’s role under FERPA
When a School uses the Services, Athena acts as a “school official” with a legitimate educational interest under the Family Educational Rights and Privacy Act (FERPA, 20 U.S.C. § 1232g; 34 CFR 99.31(a)(1)(i)(B)). This means Athena:
- performs a security function the School would otherwise perform with its own employees;
- is under the School’s direct control regarding the use and maintenance of education records;
- uses education records only for the purposes the School has authorized; and
- does not disclose education records to any other party except as directed by the School or required by law.
Athena also complies with applicable state student privacy laws, including Texas Education Code Chapter 32, Subchapter D; New York Education Law § 2-d and 8 NYCRR Part 121; California Education Code § 49073.1 and the Student Online Personal Information Protection Act (SOPIPA); and the Illinois Student Online Personal Protection Act (SOPPA).
3. What student data the Services collect
The Services do not integrate with student information systems, rosters, or student ID systems. Athena maintains no list of a School’s students.
The Services collect or hold the following data that may identify a student:
| Data element | How it is created | Who controls it |
|---|---|---|
| Alert images (image of a flagged object and the person carrying the suspected object) | Generated automatically when the detector alerts | The School |
| Incident records (student name, description of the incident, related images, and any other fields the School configures) | Created manually by School staff after an alert | The School |
| Audit logs (which authorized user viewed, exported, or changed a record, and when) | Generated automatically | The School and Athena (Athena retains its own access logs) |
The School decides which fields an incident record contains and whether a student’s name is entered at all.
4. How Athena uses student data
Athena uses student data only to provide, maintain, secure, and support the Services for the School. Athena does not:
- sell, rent, or trade student data;
- use student data for advertising or marketing of any kind, including targeted advertising;
- build a profile of any student for any purpose other than the security function the School has authorized;
- use student data, including alert images, to train, test, or improve Athena’s detection models or any other product; or
- disclose student data to any third party except the subprocessors listed in Section 7, or as required by law after notice to the School where legally permitted.
5. Security
Athena protects student data with the following controls, verified through an annual SOC 2 Type II audit:
- Device-side encryption. Alert images are encrypted on the screening tablet before transmission, using keys held only on the tablet. Images cannot be decrypted in Athena’s cloud or web interface.
- On-device detection. AI detection runs on the screening device at the School’s site; only the resulting alert is transmitted.
- Encryption in transit and at rest. All data is encrypted using TLS 1.3 in transit and AES-256 at rest on AWS and Linode infrastructure in the United States.
- Two-factor authentication is required for all access to personally identifiable information.
- Access limited to business need. Athena staff may access a School’s data only when a support ticket opened by that School requires it. Access is logged and reviewed.
- Audit logging. All access to and changes of student data are logged. Schools can view all audit logs for their own data.
- Notifications by link. Alert notifications to staff devices contain a login-protected link, not the image. Links expire after a School-configured period, typically 12 hours.
- Vulnerability management. Third-party penetration testing annually and continuous vulnerability scanning weekly.
- Staff training. All Athena staff with potential access to School data complete privacy and security training, including FERPA obligations, on hire and annually.
6. Retention and deletion
The School controls retention. Within the Athena Compliance Platform the School sets retention periods separately for confirmed-threat records and non-threat records, so that state requirements to preserve violence incident records (for example, five years) can be met while routine alerts are cleared on a shorter schedule. If a School has not configured retention, both record types default to five years.
The School may request deletion of any record at any time by opening a support ticket; every deletion runs through a ticket so the School has an audit trail of each request. On termination of the agreement, Athena will delete all School data within 30 days of the School’s written request and confirm deletion in writing. Deleted data is purged from backups within 30 days. Athena retains only aggregated, de-identified operational data that cannot be used to identify any student.
7. Subprocessors
Athena’s current subprocessors, the purpose and location of each, are published at athena-security.com/compliance/subprocessors and are incorporated into this policy by reference. Each subprocessor is bound by contract to protections at least as strong as this policy. No subprocessor other than those listed receives student data.
Athena will notify Schools at least 30 days before adding a subprocessor that will handle student data, and a School may object in writing.
8. Parent and eligible student rights
Parents and eligible students may inspect and request correction of education records through their School, as FERPA provides. Athena supports the School by:
- allowing the School to grant a parent direct access to audit logs and reports for their student within the platform;
- allowing the School to export any record;
- correcting or deleting a record at the School’s direction; and
- responding to School requests within 10 business days.
Athena does not respond directly to parent requests; parents should contact their School, which controls the data.
9. Security incidents
If Athena becomes aware of unauthorized access to or disclosure of a School’s student data, Athena will notify the School within 72 hours of discovery, provide the information the School needs to meet its own notification obligations, cooperate with the School’s investigation, and take steps to prevent recurrence. Athena publishes all security incidents at status.athena-security.com. Athena will not notify parents or the public directly unless directed by the School or required by law.
10. Changes to this policy
Athena will post material changes at least 30 days before they take effect and notify Schools in writing. Changes will not reduce protections for data collected under an existing agreement without the School’s consent.
11. Contact
Athena Security, 248 Addie Roy Rd, C101, Austin, TX 78746. Privacy questions: [email protected].