How Classwork is building SOC 2 Type 2 readiness to protect student data at scale

In EdTech, trust isn't earned with features. It's earned with proof that student data is safe.

Classwork (formerly TeacherMade) is an education technology platform that helps teachers create interactive digital assignments and assessments. Schools and districts across the US rely on it daily, which means Classwork handles sensitive student personally identifiable information (PII) at scale.

For school districts evaluating new technology, SOC 2 Type 2 compliance is increasingly a requirement, not a nice-to-have. When procurement teams ask "Are you SOC 2 compliant?" the answer needs to be yes. Anything less can stall or kill a deal.

Laura Bresko, Classwork's CEO, put it simply: "We are excited to be going through this process using ComplyJet. Can't wait to be able to say 'Yes!' to the SOC 2 Type 2 compliance question."

The Challenge

The team needed to:

• Build a complete SOC 2 program from scratch
• Handle the regulatory weight of student PII (which carries specific legal protections)
• Get their engineering, operations, and leadership teams aligned on compliance tasks
• Do all of this without slowing down product development for the schools depending on them

Getting Started

Classwork evaluated ComplyJet thoroughly before signing, testing the platform in a sandbox environment over several weeks. Adam Haymond, who leads the technical compliance effort, provided detailed product feedback during the evaluation, covering everything from infrastructure ownership models to task tracker integration.

Once onboarded, the team moved fast:

• AWS connected and monitored, with ComplyJet building AWS tag-based support specifically to handle Classwork's ephemeral resource challenge
• Jira integrated as the task tracker for managing compliance workflows
• ComplyJet's Device Agent deployed across both Mac and Windows machines, eliminating the need for a separate MDM tool
• Security policies generated and distributed for team review
• Employee onboarding kicked off with training and compliance task assignments

Product Feedback That Shaped the Platform

What set Classwork apart was the quality of their feedback. Adam's questions weren't just about getting things working. They pushed the product forward:

• Flagged the need for AWS tag-based scoping to handle ephemeral resources. ComplyJet built it.
• Raised questions about infrastructure ownership models for shared resources like databases and compute instances.
• Flagged task tracker integration nuances that improved the workflow for all customers.

Each piece of feedback was addressed, most within the same week. The Classwork team wasn't just using the platform. They were helping make it better for every customer after them.

Where Classwork Stands Today

Classwork is actively building toward SOC 2 Type 2 readiness:

• All core integrations connected (AWS, Jira, Device Agent)
• AWS ephemeral resource handling in place via tag-based scoping
• Security policies drafted and under review
• Device management active across Mac and Windows
• Employee training and task assignments underway

The compliance program is taking shape alongside the product, not competing with it.

Why This Matters

EdTech companies face a specific kind of compliance pressure. Student data is protected by regulations like FERPA, and school districts are increasingly requiring SOC 2 Type 2 reports before approving new vendors.

For Classwork, SOC 2 isn't just about checking a box. It's about earning the trust of schools, parents, and districts who need to know that student information is handled with the same care they'd expect from any enterprise-grade platform.

The fact that Classwork's feedback is actively shaping ComplyJet's product makes this more than a vendor relationship. It's a partnership where both sides are building something better.

Looking Ahead

Classwork is on track to complete their SOC 2 Type 2 attestation. With continuous monitoring running across their AWS infrastructure and a compliance program built to handle the unique challenges of EdTech, they'll be ready when the next district asks the question.

And this time, the answer will be yes.