Strata Pass
Students and privacy
A pass record names a student and is kept by the school, so Strata Pass treats it as part of the education record. This page says what is kept, who sees it, and for how long.
What is kept about a student
A student directory: first and last name, student number, school, graduation year, a directory id used to match the next sync, the directory email used only for matching (never to send anything), and an optional photo. Then the passes: type, from, to, who issued it (for a kiosk pass, the kiosk it came from), when it started and ended, how it ended and who ended it, any staff note, any rule override, and any reason recorded on it (a cancelled appointment's, or one typed at End on an older pass).
What Strata Pass never holds
Grades, discipline, IEP or 504 status, health information, guardian contacts, addresses, schedules or rosters, attendance, or anything written by a student. Appointment passes carry a destination, never a reason. A pass exception carries a short staff note.
Students never sign in
Students are not users. They have no account, no password, no permissions, and cannot be added to a group or a policy. A kiosk is signed in with a teacher's kiosk code, or with a location's own code for a shared space such as a library, and the device holds no staff credential. The kiosk shows only the first name and photo of whatever student number is typed, whoever types it (the photo is the wrong-number check), and when that student is already out from another room it names that room. It never shows a last name, a grade or a student's pass history, it clears itself after twenty seconds, and a run of wrong numbers pauses the device for a minute.
Who can see a pass
The teacher of record and the person who created it; the teacher whose room it leaves from or goes to; staff assigned to a location it left from or went to; people with Monitor passes or Pass site administration at its site; and district-wide holders of those permissions. Everyone else gets "not found". A student's history is available to people with Pass reports at the student's school, and at a school the student had passes at (that school's passes only), and every CSV or PDF export of it is written to the audit log with the exporter's name. An event list (Athletics/Events) is emailed to district addresses only, at the district's sign-in domains, and every send is written to the audit log with its addresses. A pass's reason (a cancel reason, or a reason typed at End on an older pass) is shown only to people with Pass site administration at the pass's school. In the Reports Audit Log, a pass exception names the student only for people with Pass site administration.
How long records last
A student's record is kept while they are enrolled. The photo is deleted the day they are withdrawn. The rest is kept for the remainder of the school year they left in plus two full school years, then erased automatically: the name, student number, email and graduation year are removed for good, and the pass history stays under "Erased Student". A Platform Administrator can erase a withdrawn student sooner from Admin > Students. A student who returns before erasure is reactivated as themselves, without the photo; one who returns after it is a new record. Pass history is kept for good. Directory sync logs are kept ninety days. Teacher kiosk sign-ins are kept ninety days; location kiosk sign-ins are kept for good. Configuration changes stay in the audit log for the life of the district's account.
When a parent asks for the record
The per-student history under Reports (Find a student), exported as PDF, is the student's pass record. Each export is written to the audit log with the name of the person who made it.