MySchoolBucks
Heartland School Solutions
Round 2
At a glance
An online payment platform that allows parents and guardians to add funds to student accounts for school meals, activities, and fees, and enables schools to manage cafeteria point-of-sale transactions and payment reporting.
Category (override):
Administrative details
Illustrative admin fields — real values load from contracts / vendor records in production.
Round 1 · Privacy Triage
Insufficient — Request Data-Processing Agreement
📄 Looks like a website privacy policy, not a data-processing agreement.
This reads as a general website privacy policy, not a data-processing agreement: 11 of 17 questions are simply not addressed. That's a wrong-document signal, not a vendor judgment — the 73.3% reflects silence, not bad practice. Enterprise vendors' real assurance lives in their DPA, a security cert (e.g. ISO 27001), or a completed questionnaire. Request those and assess in Round 2.
Addresses only 6 of 6 of the
student-data checklist — the score reflects silence, not the vendor's posture. Request the DPA + ISO 27001
and assess in Round 2 (deep review).
Re-vet from the live policy
(re-reads the vendor's published policy set now — privacy policy plus the security, sub-processor and terms pages it links to — and re-runs Round 1. The current verdict stays until the new one lands; a partial or blocked page never replaces it.)
Round 2 · Vendor-supplied documents
What the vendor sent you — a data-processing agreement, a completed security questionnaire, a SOC 2 or ISO summary, a contract. Stored with this record. Every re-vet and every Drift Sentinel scan reads these first, ahead of the public pages, and quotes from them carry evidence tier T2 (contractual) instead of T3 (public claim).
No vendor documents on file. Round 1 reads the public policy set only.
Add a document (PDF, DOCX, TXT or MD, up to 25 MB — or paste the text). It re-vets the vendor as soon as it is stored.
…or paste the document text
Demo: — labelled as a sample, not from the vendor.
Safeguarding summary
Round 1 privacy triage runs from the vendor's policy page.
Vetting queued — automated review pending.