Student Assignment System

Seattle Public Schools is seeking vendor input through a Request for Information to replace its aging in-house student assignment system and transportation operations system, with implementation targeted for the 2027–2028 academic year. The agency aims to procure external software solutions that require minimal customization to handle student enrollment assignments and transportation logistics, adhering to established educational policies such as sibling preference, geographic zoning, lottery systems, and accommodations for special populations including homeless students, special education enrollees, and participants in the Address Confidentiality Program. The solicitation, identified as RFI260401 and posted on May 8, 2026, with a submission deadline of June 15, 2026, is not a contract award notice but a foundational effort to gather technical, operational, and compliance insights from the vendor community prior to a future procurement. Responses must be submitted electronically through the Bid Locker portal, and all communication must go through the designated point of contact. Vendors are required to demonstrate strict adherence to data privacy and security protocols under federal and state laws including FERPA, COPPA, SOPIPA, and Washington State RCW 28A.604. Data must be encrypted in transit using TLS 1.2 or higher and at rest using AES-256, with role-based access controls and multi-factor authentication enforced for all privileged accounts. Vendors must certify compliance with security frameworks such as SOC 2 Type II or ISO/IEC 27001, provide recent third-party penetration test results, maintain cyber liability insurance, and retain security logs for 365 days. All student and district data must be used solely for contracted services, with AI and machine learning model training prohibited without explicit written authorization. Vendors must disclose all sub-processors annually, including their geographic locations and data handling purposes, and provide a complete inventory of data hosting, backup, and disaster recovery sites. Any changes to sub-processors or data locations require 30 days’ advance notice. Upon contract termination, all data must be securely deleted within 10 business days in compliance with NIST SP 800-88, and vendors must certify this deletion. Data return in usable format is required upon request, and vendors must describe their incident response and business continuity plans. Performance is restricted to Washington State, and no physical packaging, delivery, or shipping requirements apply as all obligations pertain to digital service delivery and data governance.