Every district is one incident away from a lawsuit. Inovantics is how you prove you did everything right.
Inovantics is built on a security and compliance program designed for the scrutiny that comes with handling student transportation data. FERPA-aligned. NIST CSF 2.0 mapped. The work is visible — not promised.
This page describes Inovantics' current security architecture and compliance program. Controls are actively being implemented and documented.
We handle data that matters. We treat it that way.
Student transportation sits at the intersection of children's safety, federal funding, and public accountability. Every system that touches it should be able to show its own work — not point to a badge and ask for trust. This page is how Inovantics shows its work.
Controls mapped to recognized frameworks — implemented and documented.
What this means
Inovantics' security controls are mapped to industry-recognized frameworks and are actively being implemented and documented. The program is built and operated in partnership with Mostro Cybersecurity & Compliance.
What this does not mean
We do not reference an auditor, a timeline, or a certification status of any kind. We will not use certification language until an engagement is formally underway and the report is in hand.
The work is being done. The evidence is being built. Documentation is available on request.
The regulations that govern student data. Mapped, not just mentioned.
FERPA
Student records are protected under FERPA. Inovantics handles student-adjacent data under FERPA-aligned controls — minimum necessary data collection, no third-party sale or disclosure, district retains ownership of all records.
COPPA
Inovantics' data collection architecture is designed to comply with COPPA, including the April 2026 biometric amendments, for all student-facing and student-adjacent systems. Biometric verification applies to adult drivers only.
NDAA Section 889
Inovantics hardware components are vetted against the NDAA Section 889 prohibited vendor list and the FCC Covered List. Districts receiving Title I, IDEA, or other federal funding are protected from supply-chain compliance risk. Documentation available on request.
Massachusetts Controls
CORI/SORI handling under MGL c.6 §172. Commercial driver credentialing under MGL c.90 §7B. Special education transport under 603 CMR 28.00. All mapped into the platform's verification layers.
603 CMR 23.00
Massachusetts student records regulations govern who may access a student record and how that access is logged. Inovantics keeps transportation-related student information in a controlled channel with recorded access and district-held ownership.
IDEA Records (34 CFR §§300.610–300.627)
IEP transportation generates records subject to IDEA confidentiality requirements — some of the most sensitive data in the platform. Inovantics treats special education transportation data with heightened access restrictions, and our framework for IDEA-compliant record handling is under active development and will be reviewed by outside counsel before district deployment. Documentation available upon request for district procurement review.
Secured Communication
Driver-to-family contact runs inside the platform, not on personal phones. Access is logged, scoped to the route, and revoked the moment a driver is removed — closing a FERPA exposure most programs never documented.
Data Processing Agreements
Districts receive a written DPA covering data ownership, permitted use, sub-processors, breach notification, retention, and deletion on contract termination.
What the program actually covers.
NIST CSF 2.0
The Inovantics security program is aligned to the NIST Cybersecurity Framework 2.0. Alignment is documented and maintained continuously.
Data Encryption
All data in transit is encrypted. All data at rest is encrypted. Student data is isolated at the application layer.
Access Controls
Role-based access architecture is designed into the platform from the ground up. Multi-factor authentication is enforced for all Inovantics and MOSTRO administrative accounts. District and operator user authentication — including MFA and session controls — is in active development as part of the platform security roadmap. Privileged access is managed through a dedicated PAM platform.
Audit Logging
Every verification event, every data access, and every system change is being written to a tamper-resistant, time-stamped audit record — designed from the ground up to serve as court-admissible compliance evidence. Architecture documentation available on request.
Continuous Monitoring
Security posture is monitored continuously — not reviewed annually. Threat detection, endpoint protection, and 24/7 SOC coverage are being deployed and maintained in ongoing partnership with Mostro Cybersecurity & Compliance. Monitoring is designed to be always-on, not periodic.
Driver verification is powerful. The consent framework around it is too.
Inovantics uses facial verification technology to confirm that the driver at the wheel matches the credentialed driver on record. No driver is enrolled in biometric verification without first signing a documented consent agreement covering what data is collected, how it is used, how long it is retained, and the driver's rights — including the right to withdraw consent and have their biometric record deleted.
What is not collected: Inovantics' platform is architecturally designed to exclude biometric data collection from students. Facial verification is scoped to credentialed adult drivers only. Student biometric exclusion is a founding design principle, not a configuration setting.
Your data. Your district's data. Protected by design.
Who owns the data
Districts own their data. Operators own their operational data. Inovantics does not claim ownership of customer records.
What we do not do
Student and district data is never sold, never used for advertising, and never shared with third parties outside of documented service agreements. This is a founding commitment — not a policy subject to future revision.
Retention
Data retention schedules are defined per record type and documented in the Data Governance Policy, available on request.
We don't manage security alone — and we shouldn't.
Inovantics engages Mostro Cybersecurity & Compliance under a services agreement to build and operate its security program. Inovantics' Chief Security Officer holds an ownership interest in Mostro; this relationship is disclosed in full in our procurement documentation package.
A platform trusted with this data should have an adult in the room. Ours does — and their name is on the work.
Procurement and legal review
Districts evaluating Inovantics can contact us directly with procurement or legal questions. We will tell you what exists today, what is in development, and what has not been built yet.
What this means for everyone at the table.
You signed contracts with confidence. Now you have the evidence to back every one of them.
Data ownership, retention, and access are defined in writing before a district signs, not after.
Encrypted, access-controlled, continuously monitored, and aligned to NIST CSF 2.0.
The district chose a partner that holds itself to the same standard it asks of its vendors.
Security built for scrutiny, not for show.
The program is being built and documented as the platform is built. We will not describe a control as complete before it is.