Comparison
What ten AI grading tools say they do with student data
Before student work goes into an AI grader, your district will ask four things: is it used to train AI, which laws the vendor names, what proof it can show, and when the work is deleted. Here is what ten vendors’ own pages answer.
The Graidable team
Published
Graidable makes one of the tools compared here. Every claim about another tool links to that vendor’s own page.
| Tool | AI training | Proof | Laws named | Deletion |
|---|---|---|---|---|
| Brisk | Never used | SOC 2 Type II, state agreements | FERPA, COPPA, GDPR | Stored only during the task |
| Class Companion | No identifiable data to AI providers | State agreement by email | FERPA, COPPA, four state laws | On request |
| CodeGrade | Not stated | ISO 27001 | FERPA, GDPR | In line with FERPA |
| CoGrader | Not used; providers barred | SOC 2 Type 1 | FERPA, COPPA, SOPIPA, NY 2-d | On request or at contract end |
| EssayGrader | Not stated | NIST-aligned, A4L member | FERPA, COPPA | Within 60 days |
| GPTZero | API text not used | SOC 2 Type II | FERPA, GDPR, CCPA | Within 3 months of closing |
| Gradescope | Refines its own AI features | SOC 2 | FERPA, GDPR | When the institution asks |
| GradingPal | Not used; providers barred | CASA Tier 2, published addendum | FERPA, COPPA, SOPIPA, NY 2-d | 30 days after a request |
| Graidable | Not used; zero retention | DPA, DPIA, sub-processor list | GDPR | 30 days after you delete |
| MagicSchool | Not used; providers barred | SOC 2, 1EdTech, iKeepSafe | FERPA, COPPA | AI data within 30 days |
Brisk
- AI training
- Never used
- Proof
- SOC 2 Type II, state agreements
Class Companion
- AI training
- No identifiable data to AI providers
- Proof
- State agreement by email
CodeGrade
- AI training
- Not stated
- Proof
- ISO 27001
CoGrader
- AI training
- Not used; providers barred
- Proof
- SOC 2 Type 1
EssayGrader
- AI training
- Not stated
- Proof
- NIST-aligned, A4L member
GPTZero
- AI training
- API text not used
- Proof
- SOC 2 Type II
Gradescope
- AI training
- Refines its own AI features
- Proof
- SOC 2
GradingPal
- AI training
- Not used; providers barred
- Proof
- CASA Tier 2, published addendum
Graidable
- AI training
- Not used; zero retention
- Proof
- DPA, DPIA, sub-processor list
MagicSchool
- AI training
- Not used; providers barred
- Proof
- SOC 2, 1EdTech, iKeepSafe
In this article
Ten AI grading tools: Brisk1, Class Companion2, CodeGrade3, CoGrader4, EssayGrader5, GPTZero6, Gradescope7, GradingPal8, Graidable9 and MagicSchool10. The table under the title answers the four questions a district’s privacy review asks first. Every cell comes from the vendor’s own privacy or security pages, read on 13 October 2026.
Start with the training question
Six of the ten say in one plain sentence that student work is not used to train AI models: Brisk, CoGrader, GradingPal, Graidable and MagicSchool, plus Class Companion, which says it shares no personally identifiable teacher or student information with AI providers. Four of those six also say their AI providers are barred from training on it.
The other four word it differently, and the wording matters. Gradescope’s policy lists “refining the algorithms behind AI-based features” among the things it does with data. GPTZero makes its promise for text sent through its API. EssayGrader says student data is never sold or used for advertising. CodeGrade’s pages say student records are used only for the purpose they were shared for. If the sentence you need is missing, ask for it in writing.
The ten, in alphabetical order
“Not stated” means the pages we read didn’t say. It doesn’t mean no.
Brisk
Feedback inside Google Docs and your LMS.
- AI training
- Student and teacher inputs are never used to train, fine-tune or improve AI models
- Laws named
- FERPA, COPPA and GDPR
- Proof
- SOC 2 Type II; 1EdTech data privacy certification; National Data Privacy Agreement signed with a list of states
- Deletion
- Says it doesn’t store student work after a task is completed
- The privacy center lists the states where the National Data Privacy Agreement is signed, and says Brisk will sign district agreements where a state one isn’t possible.
- It also says personal data is never sold or shared.
Class Companion
Practice with instant feedback and retakes.
- AI training
- No personally identifiable teacher or student information is shared with AI providers; de-identified data is used for research and development
- Laws named
- COPPA and FERPA; California SOPIPA, Illinois SOPPA, New York Education Law 2-d and Maine’s student privacy act
- Proof
- A state-specific data privacy agreement in a packet sent by email; follows the NIST Cybersecurity Framework
- Deletion
- A deactivated account is de-identified; permanent deletion on request
- The policy has a section for nine states, which is more state detail than the other nine give.
- The data privacy packet is built to be forwarded to your IT department.
CodeGrade
Autograding for programming courses.
- AI training
- Not stated
- Laws named
- FERPA and GDPR
- Proof
- ISO 27001 certified; a public trust center
- Deletion
- Student records amended or deleted in line with FERPA
- The FERPA page says CodeGrade acts as a school official and uses student information only for the purpose it was disclosed for.
- CodeGrade is a Dutch company, and its privacy statement says it processes data within the European Union.
CoGrader
Rubric-based grading of written work.
- AI training
- Student work, rubrics, prompts and AI outputs are not used to train any AI model; AI providers are barred by contract
- Laws named
- FERPA, COPPA, SOPIPA and New York Education Law 2-d
- Proof
- SOC 2 Type 1 attestation; Student Privacy Pledge; sub-processor list on request
- Deletion
- When a teacher or school asks, or when the contract ends
- A data residency page says all customer data is stored and processed in the United States, on Google Cloud.
- The policy says AI providers may keep a temporary copy for abuse monitoring for up to 30 days.
EssayGrader
Essays in ELA and the humanities.
- AI training
- Not stated
- Laws named
- FERPA, as a school official, and COPPA
- Proof
- Security framework aligned with NIST SP 800-53; member of the A4L community
- Deletion
- Permanently deleted within 60 days after you delete the account or the contract ends
- The policy says student data is not used to build a profile of a student, for targeted advertising, or sold.
- The 60-day figure is the clearest deletion deadline among the ten.
GPTZero
AI-writing checks and grading in one place.
- AI training
- Text sent through the API is not stored by default or used for product improvement
- Laws named
- FERPA, GDPR and CCPA
- Proof
- SOC 2 Type II, with regular penetration testing
- Deletion
- On request; nothing kept longer than three months after the account ends
- The privacy policy says GPTZero doesn’t knowingly collect data from anyone under 18.
- The training sentence covers the API, so ask about work uploaded in the web app.
Gradescope
Paper exams and code, graded by rubric.
- AI training
- The policy lists refining the algorithms behind AI-based features as part of its processing
- Laws named
- FERPA, GDPR and California law; schools obtain parental consent for COPPA
- Proof
- SOC 2 and Cyber Essentials; Student Privacy Pledge
- Deletion
- Submissions are stored indefinitely unless the institution instructs otherwise
- Gradescope is part of Turnitin, and the policy is Turnitin’s. It says students keep the copyright in their work.
- It also says work submitted to Gradescope isn’t currently kept in Turnitin’s source database.
GradingPal
Essays and handwritten math and science.
- AI training
- Student data is not used to train AI models; AI providers are prohibited from training on it
- Laws named
- FERPA, COPPA, SOPIPA and New York Education Law 2-d
- Proof
- CASA Tier 2 verified; a published student data privacy addendum
- Deletion
- Within 30 days of a written request, for individual teacher accounts
- The student addendum and a data processing addendum are linked from the footer, so you can read them before you talk to anyone.
- The security page says data is encrypted at rest with AES-256.
GraidableOur tool
Handwritten or typed work, graded from your own rubric.
- AI training
- Student work is not used to train AI models, by us or by the AI providers; every AI call requires zero data retention
- Laws named
- GDPR
- Proof
- Data processing agreement, DPIA and the full sub-processor list, all public
- Deletion
- A deleted class is erased with its files after 30 days; a deleted account at once; anything else on request
- Students don’t use the app. The teacher uploads the work and approves every grade.
- An AI call that doesn’t meet the zero-retention rule is stopped before it is sent.
MagicSchool
A set of teacher tools, feedback among them.
- AI training
- Student data is not used to train, fine-tune or improve AI models; AI vendors are barred from training on it
- Laws named
- FERPA and COPPA
- Proof
- SOC 2; 1EdTech certified; iKeepSafe FERPA badge; data privacy agreements a district can customize
- Deletion
- Data sent through AI services is deleted within 30 days; a district controls the student data it manages
- The privacy policy says students under 18 reach MagicSchool only through a school’s agreement.
- It lists selling student personal data among the things it does not do.
Which laws a vendor names tells you who it sells to
Nine of the ten are written for American schools and name FERPA. Most add COPPA, and three go down to state level: Class Companion, CoGrader and GradingPal name California’s SOPIPA and New York Education Law 2-d. Brisk’s page is the one that lists, state by state, where it has signed the National Data Privacy Agreement, the standard contract many districts use.
Graidable is ours, and it is written to the GDPR, with the documents a European school asks for. CodeGrade, a Dutch company, names both.
A law named on a page is a claim. An audit report, a signed agreement or a published contract is proof. That is why the table has a column for each.
“Deleted” has four meanings
Read the deletion cell for the trigger. EssayGrader and GradingPal give a deadline in days. Graidable erases a class 30 days after you delete it. CoGrader, Class Companion and GPTZero delete when you ask or when the account ends. Gradescope keeps submissions until the institution says otherwise, which fits a university that wants exams on file for regrade requests.
Two vendors also say what the AI provider keeps. CoGrader’s providers may hold a temporary copy for up to 30 days; MagicSchool gives 30 days as well. We require zero retention on every call.
Send these five questions before a pilot
Paste them into one email. A vendor that sells to schools answers them every week.
Five questions for an AI grading vendor
- Is student work used to train or improve any AI model, yours or your AI provider’s? Please point to the sentence in your policy.
- Which companies receive student work, and may I have the sub-processor list?
- How long does your AI provider keep a copy of each request?
- What is deleted when I delete a class, and what when my account closes? After how many days?
- Which agreement will you sign with my district, and has my state’s been signed already?
Then try the tool on answers you wrote yourself, or on work with every name removed. You will know whether the grading is worth a privacy review before you start one.
Graidable is the tool we make. This part is about it.
Where Graidable fits
Graidable is one of the ten. It is GDPR-compliant, and the data processing agreement, the DPIA and the sub-processor list in the privacy policy are public pages you can send to whoever reviews tools at your school. Students never log in: you upload the work, Graidable drafts a score and a comment for each criterion, and you approve every grade. We compare the same tools by price in Free AI grading tools for teachers.
Sources
-
Brisk Teaching, Privacy Center. Checked 13 October 2026. ↑
-
Class Companion, Privacy Policy, Security and Data Privacy. Checked 13 October 2026. ↑
-
CodeGrade, FERPA, Security and Privacy Policy. Checked 13 October 2026. ↑
-
CoGrader, Privacy Policy and Data Residency. Checked 13 October 2026. ↑
-
EssayGrader, Privacy Policy. Checked 13 October 2026. ↑
-
GPTZero, Privacy and security, Privacy Policy and For educators. Checked 13 October 2026. ↑
-
Gradescope, Privacy (Turnitin’s policy). Checked 13 October 2026. ↑
-
GradingPal, Privacy Notice and Security. Checked 13 October 2026. ↑
-
Graidable, Privacy Policy and Data Processing Agreement; the tool is ours. Checked 13 October 2026. ↑
-
MagicSchool, Privacy and Privacy Policy. Checked 13 October 2026. ↑