<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#ffffff" text="#000000"> David Hopkins wrote: <blockquote cite="mid:bad371bd0812050902u198818duc3163ea73be1d578@mail.gmail.com" type="cite"> <pre wrap="">On Fri, Dec 5, 2008 at 11:54 AM, Dan Young <a class="moz-txt-link-rfc2396E" href="mailto:dyoung@mesd.k12.or.us"><dyoung@mesd.k12.or.us></a> wrote: </pre> <blockquote type="cite"> <pre wrap="">On Fri, Dec 5, 2008 at 8:35 AM, Will Hatch <a class="moz-txt-link-rfc2396E" href="mailto:whatch@anwsu.org"><whatch@anwsu.org></a> wrote: </pre> <blockquote type="cite"> <pre wrap="">Since google docs is not encrypted, isn't if a violation of FERPA? I'd like to use it, but our tech director tells me that it is not secure, and since student names/information could be part of the documents, that it can't be used. I would like to hear Google's feelings on this, since they seem to be interested in education. </pre> </blockquote> <pre wrap="">It is encrypted automatically for all users when the Google Apps administrator ticks a box forcing SSL on: <a class="moz-txt-link-freetext" href="http://www.google.com/support/a/bin/answer.py?hl=en&answer=100181">http://www.google.com/support/a/bin/answer.py?hl=en&answer=100181</a> -- </pre> </blockquote> <pre wrap=""> A quick google leads to <a class="moz-txt-link-freetext" href="http://www.google.com/support/a/bin/answer.py?hl=en&answer=60762">http://www.google.com/support/a/bin/answer.py?hl=en&answer=60762</a> where one answer says that any administrator (implied Google administrator?) can access any account per their terms of service. Encryption or not, this could be an issue (especially if foreign nationals have access to US citizens/students data and vice-versa?) It is convenient, and useful but it is not what I would call secure given the terms of service that google requires you to agree to. Just my (uninformed) two cents. Dave Hopkins </pre> </blockquote> We have NDA's with every company with whom we "farm out" storage of any sensitive information, with severe financial penalties (as well as the usual legal ones) if the company doesn't honor it. If Google won't give you an NDA like that, then yep, it's illegal (at least in Virginia) for sensitive info. I'd say, don't risk it. --TP </body> </html>