Epic!

Epic Creations, Inc.

Conditional

At a glance

Administrative details

Application type

Web + iOS / Android

MFA / SSO

Supported

Schools using

Group pricing

Not available

Pricing tier

Tier 3 (>$10k)

User type

Students & Staff

Account manager

Tom Alves

Customer success

Epic Creations, Inc. Customer Success

Illustrative admin fields — real values load from contracts / vendor records in production.

Round 1 · Privacy Triage

Approve with conditions

Privacy score 100.0% · band Best · addresses 14 of 18

Strong privacy posture (100.0%, Best); no violations. Two mandatory gates are unaddressed (Q6 (Data Sharing); Q16 (AI & Model-Training)) — approve on the condition they are confirmed; Round 2 optional, not blocking. Scope note: 1 question(s) in the current rubric were not assessed in this run — Q19 (Data Security). The evidence predates them, so they are excluded from the 100.0% rather than scored as silence. Re-run the extractor to close the gap.

Waive a finding that doesn't apply to your school (e.g. a feature you don't enable). Re-scores instantly; recorded as a cited footnote.)

Q6 · Data Sharing — Does the vendor impose contractual limits on how third parties use shared personal information? answer: unclearQ16 · AI & Model-Training — Does the vendor use student/user data — including uploaded content — to train, fine-tune, or improve AI/ML models? answer: unclear

Re-vet from the live policy (re-reads the vendor's published policy set now — privacy policy plus the security, sub-processor and terms pages it links to — and re-runs Round 1. The current verdict stays until the new one lands; a partial or blocked page never replaces it.)

View full cited report ↗

Round 2 · Vendor-supplied documents

What the vendor sent you — a data-processing agreement, a completed security questionnaire, a SOC 2 or ISO summary, a contract. Stored with this record. Every re-vet and every Drift Sentinel scan reads these first, ahead of the public pages, and quotes from them carry evidence tier T2 (contractual) instead of T3 (public claim).

No vendor documents on file. Round 1 reads the public policy set only.

Add a document (PDF, DOCX, TXT or MD, up to 25 MB — or paste the text). It re-vets the vendor as soon as it is stored.

…or paste the document text

Demo: — labelled as a sample, not from the vendor.

Safeguarding summary

Advisory: Insufficient Evidence — Round 2 Required. No security risks were identified, but the reviewed source(s) don't document enough to clear this vendor: 12 domain(s) have no evidence and the rest are self-asserted (unverified). This is NOT a finding that the vendor is risky — it means we can't yet confirm they're safe. Request the documents below (SOC 2 / ISO 27001 / DPA / completed questionnaire), then re-assess.

Insufficient evidence to approve — pilot pending Round 2.