--- title: "FERPA-Compliant AI Platform for Higher Education: By Deployment, Not by Promise" slug: "ferpa-compliant-ai-platform-for-higher-education" author: "ibl.ai Engineering" date: "2026-06-01 16:15:00" category: "Premium" topics: "FERPA compliant AI platform, FERPA AI higher education, FERPA AI university, FERPA AI deployment, student data AI FERPA, self-hosted AI FERPA, FERPA AI advising, FERPA AI tutoring, university AI compliance, campus AI student data residency" summary: "FERPA-compliant AI isn't about a vendor's BAA-equivalent — it's about where student records live during the inference call. ibl.ai's runtime executes inside the campus VPC alongside the SIS and LMS, so FERPA-protected records never leave the institution's perimeter." banner: "" thumbnail: "" --- ## The Short Answer **FERPA-compliant AI for higher education isn't a vendor promise — it's a deployment fact.** ibl.ai's runtime executes inside the campus VPC (often the same VPC as Banner / PeopleSoft / Workday Student + Canvas / Blackboard / Moodle), so FERPA-protected student records (transcripts, financial aid, advising notes, IEP documentation) never traverse a third-party AI vendor's cloud. ## What FERPA Compliance Actually Requires of AI FERPA — the Family Educational Rights and Privacy Act — restricts the disclosure of student records to third parties without consent. Three structural questions every institution's general counsel asks of any AI vendor: 1. **Where do student records live during the AI inference call?** 2. **Who has access to logs and intermediate state?** 3. **What contractual + technical controls prevent the vendor from using student data for model training, evaluation, or quality-improvement?** A managed AI vendor can answer (3) with a strong DPA. They can answer (2) with role-based access controls. **They can't answer (1) without the data physically transiting their cloud.** Self-hosted on the institution's infrastructure makes question 1 a no — the records never leave. ## How ibl.ai Ships FERPA-by-Deployment **The agent runtime executes inside the campus VPC.** Same network as Banner / PeopleSoft / Workday Student (SIS), Canvas / Blackboard / Moodle / D2L (LMS), Slate / Salesforce Education Cloud / EAB Navigate (CRM). **Integrations terminate inside the campus.** When the AI agent needs to pull a student's degree audit from Banner or check current LTI course progress in Canvas, the connector executes inside the same VPC. The API calls don't traverse a vendor's cloud. **The model can run on campus infrastructure.** Open-weight models (Llama 4, DeepSeek-R1, Qwen 3 for multilingual) execute on the institution's GPU. For workloads that need frontier models (Claude Opus, GPT-5, Gemini Pro), API calls route through a campus-controlled proxy that enforces data residency and logs every request to the campus SIEM. **The control plane sees orchestration metadata, not student records.** The Ed25519-signed WebSocket between the campus-hosted runtime and the ibl.ai platform carries which-mentor-which-skill-which-model-class metadata. Student data never crosses that boundary. For the full FERPA-aligned architecture (Banner / PeopleSoft / Workday Student + LMS via LTI 1.3 + APIs + MCP), see **[Higher Education AI Reference Architecture on ibl.ai](/blog/higher-education-ai-reference-architecture)**. ## Workloads Where FERPA Matters Most Three classes of campus AI workload where the FERPA-by-deployment story is non-negotiable: **Academic advising.** Every advising conversation contains FERPA-scope data — degree audit, registration status, GPA, financial-aid scenarios. Conversation transcripts are FERPA-protected student records. Self-hosted means the transcripts stay on the campus's SIS-adjacent infrastructure. For the per-conversation cost math + vendor comparison: **[What AI Academic Advising Actually Costs in 2026](/blog/what-ai-academic-advising-actually-costs-2026)**. **Tutoring.** Tutoring session logs contain FERPA-scope student-performance data — what the student struggled with, what accommodations were used, what the agent observed. Districts and campuses serving multilingual learners need locally-controlled language support (Qwen 3 for Spanish/Mandarin/Arabic). For the cost math: **[What AI Tutoring Actually Costs in 2026 (K-12 + Higher Ed)](/blog/what-ai-tutoring-actually-costs-2026)**. **Financial-aid agents.** FAFSA scenarios, aid-package decisions, family-income context. All FERPA-scope. The institution's general counsel reviews where this data lives before any AI deployment. ## The Cost Math at Campus Scale A 30,000-student university running advising + tutoring + course-content generation (~89M input + 120M output tokens/month): | Approach | Monthly cost | Student-data location | |---|---:|---| | **ChatGPT Enterprise** ($60 × 33K) | **$1,980,000** | OpenAI cloud | | **ChatGPT Edu** (~$25 × 33K) | **$825,000** | OpenAI cloud | | **Microsoft 365 Copilot Edu** ($30 × 33K) | **$990,000** | Microsoft cloud | | Direct Claude Sonnet API | ~$2,067 | Anthropic cloud | | **ibl.ai self-hosted (Llama 4 / Qwen 3)** | **~$5,000–10,000** | **Inside campus VPC** | ibl.ai self-hosted is ~100× cheaper than ChatGPT Edu for the same workload, with FERPA-protected records inside the institution's network. For the segment cost math: **[AI Cost Math for Higher Education: Per-Seat vs Usage-Based in 2026](/blog/ai-cost-math-for-higher-education-per-seat-vs-usage)**. ## FERPA Posture Differences That Matter | | Managed AI vendor (DPA) | ibl.ai self-hosted | |---|---|---| | Student-record location during inference | Vendor cloud | **Inside campus VPC** | | FERPA DPA scope | Renewed annually | None needed for the runtime | | Audit log location | Vendor's infrastructure | Campus SIEM | | Sub-processor changes | Trigger DPA review | N/A | | Model swap | Vendor approval cycle | Config change inside campus | | Multilingual model choice | Vendor's selection | Campus's choice (Qwen 3 for Spanish, etc.) | | Air-gapped option (for special programs) | Rarely | Fully supported | ## Deployment Tiers **Managed VPC** — campus's existing AWS / Azure / GCP environment. Same VPC as SIS / LMS. Fastest path; suits 80% of campus workloads. **On-premise** — campus data center (some R1 institutions with significant on-prem infrastructure prefer this). **Hybrid** — Managed VPC for general faculty pilot + on-premise for institutional production. See **[Higher Ed AI Blueprint: Hybrid Rollout for FERPA Campuses](/blog/higher-ed-ai-blueprint-hybrid-ferpa-campuses)**. ## Run the Numbers - **[Higher Education AI Reference Architecture](/blog/higher-education-ai-reference-architecture)** — full FERPA-by-design architecture (mirrors Syracuse + SUNY deployments) - **[AI Cost Math for Higher Education](/blog/ai-cost-math-for-higher-education-per-seat-vs-usage)** — segment cost math - **[What AI Academic Advising Actually Costs in 2026](/blog/what-ai-academic-advising-actually-costs-2026)** — per-conversation math - **[What AI Tutoring Actually Costs in 2026](/blog/what-ai-tutoring-actually-costs-2026)** — per-session math - **[Self-Hosted AI vs ChatGPT Enterprise for Higher Education](/resources/comparisons/self-hosted-ai-vs-chatgpt-enterprise-for-higher-education)** — deployment comparison - **[Higher Ed AI Blueprint: Hybrid Rollout for FERPA Campuses](/blog/higher-ed-ai-blueprint-hybrid-ferpa-campuses)** — staged deployment recipe - **[AI and FERPA Compliance: What Higher Ed Needs to Know](/blog/ai-and-ferpa-compliance-what-higher-ed-needs-to-know)** — broader FERPA framework ## Why Family-Owned and New York Matters Here A university's AI vendor relationship for workloads as central as advising and tutoring is a multi-year commitment that touches FERPA-protected records and student-success outcomes accreditors scrutinize. ibl.ai is **family-owned and operated from New York, NY** — a U.S.-headquartered, domestically-owned, long-term partner with a perpetual platform license and no investor exit pressure. The runtime is open source. The FERPA-protected records stay inside the campus VPC. The math works at a 2,000-student community college or a 200,000-student multi-campus system like SUNY. FERPA-compliant AI isn't an enterprise SKU. It's the architecture.