Compliance
Data-privacy, residency, and accessibility evidence for District Technology Services.
Data Privacy Agreement (NDPA)
- Status
- Acknowledged Jun 19, 2026
- Acknowledged by
- Dana Whitfield
- Exhibit
- Colorado Student DPA (Exhibit E)
Data residency
United States — AWS us-west-2 (Oregon). No offshore processing.
DR / continuity: RPO 1 hour / RTO 4 hours; daily encrypted backups; multi-AZ failover.
Breach notification & incident response
- Breach commitment
- 72-hour notification
- Security contact
- Ridgeline Security Operations · security@ridgeline.example
- Escalation path
- L1 Support → L2 Security Engineer → Account Manager → District DPO
Accessibility (WCAG / HB21-1110 / VPAT)
Conformant with WCAG 2.1 AA and Colorado HB21-1110. VPAT/ACR available on request.
Data retention & legal hold
Case records retained per district policy with legal-hold override; screeners retained 7 years; audit events immutable and never purged.
Subprocessor register
| Name | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting & storage | United States (us-west-2) |
| SendGrid (Twilio) | Transactional email delivery | United States |
| Datadog | Application monitoring & logging | United States |