1

I work for a K12 school district. I find the environments to be really easy to bring up and it seems feature complete so far.

I know my IT Director and Superintendent will ask if it is FERPA compliant. I am not finding any attestation so far and since the service is cloud-only I cannot assuage their fears by simply ramping up an on-prem (as I read the on-prem solution is no longer being developed).

Also, who owns Spiceworks? Since it appears to be free, how do they stay afloat?

1 Spice up
2

Spiceworks products are not compliant to any formal standards.

You can read the privacy statement for most questions, but there are no official compliances.

Spiceworks Privacy Policy.

FYI, the long-dead on-prem solution was also not compliant.

Spiceworks is owned by Ziff-Davis.

Sponsors from companies like Dell, HP/HPE, Microsoft, Action1, KnowB4, VMware/Broadcom etc. Companies who are also part of this community (known as green guys). They also draw funding from adverts on the site.

I hope this helps.

2 Spice ups
3

Rod got most of it (as usual), I just want to plug these two pages in case they help:

1 Spice up
4

From these it doesn’t look like it would take much to register a domain as an educational enterprise and allow them to use Spiceworks in a FERPA-compliant manner.

The reason we choose to adhere to FERPA so strongly is any staff member may mistakenly put student PII in any ticket/case at any time.

These are the certifications Spiceworks can attain. Any single one should work.

FERPA Seal, SOC 2 (Service Organization Control 2), SOC 3 (Service Organization Control 3), ISO/IEC 27001:2013 (Information Security Management System), CSA STAR (Cloud Security Alliance Security, Trust & Assurance Registry)

This would appeal to K12 and higher education enterprises.

5

This data shouldn’t really be in tickets but I do understand sometimes people don’t know this type of data shouldn’t and add it anyway. To counter this, staff should be trained to know this type of data should not be entered anywhere outside of specific places (that are documented).

If you need a solution quickly, my advise would be to keep looking and not wait to see if this happens, while you may benefit from this, Spiceworks may have no desire to pursue this, at least not in a timely manner.

There may also be additional costs and securities, encryption and other complexities to obtain or deal with which may mean Spiceworks can no longer offer a free product.

@Sean-Spiceworks can probably answer these more directly, but above are my views based on my length of time in the community.

Good luck

1 Spice up