Usually not the full documents. Most SIS platforms indicate whether a student has an IEP or 504 plan, but the detailed plan documents live in a specialized special education management platform (SEAS, Frontline, Skyward SPED, or district-built systems). The SIS is where you note the accommodation exists; the specialized platform is where the plan is developed and stored.

Basic health indicators yes: immunizations, allergies, medical alerts, medications administered during school hours. Detailed medical records, physician notes, or protected health information typically live elsewhere. Nurse notes vary - some districts keep them in the SIS, others use a specialized nurse management platform.

Some do, some don't. States vary in requirements. Where SSNs are stored, they should be encrypted, access-controlled, and typically limited to registrar-level users. Many districts have moved away from storing full SSNs in the SIS due to privacy risk, using state-assigned student IDs instead.

Not directly. The SIS typically stores free/reduced meal eligibility status (yes or no) rather than actual family income. The determination is made elsewhere - through the free/reduced meal application system - and the eligibility flag flows to the SIS for program participation and reporting purposes.

Most modern SIS platforms support student photos, though whether they're used varies by district. Photos help with identification for substitute teachers, security staff, and lunch service. Districts should have clear policies on who can access photos and how they're managed. Some states have specific rules on student photo consent and retention.

Varies by data type and state requirements. Academic records (transcripts, historical grades) are often retained indefinitely - a student may need their transcript decades after graduation. Attendance and discipline records typically follow state retention rules (often 5-7 years). Current-year operational data is retained as long as needed for reporting cycles. Districts should have documented retention policies aligned with state requirements.

Access is controlled by role and legitimate educational interest (a FERPA concept). Teachers see students in their classes. Building administrators see students in their building. Counselors see their caseload. District administrators see broader data. Registrars and specific administrators see sensitive data (health, discipline, special populations). Families see only their own students. Students of appropriate age see their own records.

Alma encrypts data at rest and in transit, enforces role‑based access control, maintains comprehensive audit logs, undergoes SOC 2 Type II auditing, and provides districts with data ownership and portability. Ask specifically about the data types your district cares about most and the controls that apply.