Open house is behind you, inquiry forms are coming in, and over the next few months families will hand your school the most sensitive documents it will hold all year. Not transcripts — tax returns. W-2s. Income statements. Social Security numbers for parents and children. Sometimes divorce decrees and custody agreements alongside them.
Schools think carefully about student records because FERPA trained them to. Admissions and financial aid files rarely get the same attention, even though the data is more sensitive and the people handling it are often part-time, seasonal, or volunteers helping through a busy stretch. The exposure isn't the collection — you need the documents. It's where they land afterward.
Follow one financial aid application through your school
Trace a single family's file end to end and the gaps show up fast:
- It arrives by email. A parent attaches last year's 1040 to a message sent to the admissions address, or to an individual staff member who then forwards it to two more people. That document now sits in three mailboxes indefinitely.
- It gets downloaded "just to review." A copy lands in someone's Downloads folder, maybe on a personal laptop they use at home during the evening reading push.
- It gets printed for the committee. Paper copies circulate through a meeting, and afterward some go in a drawer rather than a shredder.
- It stays forever. The family enrolls or doesn't, and either way nobody decided when those tax returns get deleted. Five admissions cycles later, they're still there.
Four fixes, none of them expensive
- Stop accepting financial documents by email. Use your admissions platform's secure upload, or a shared folder with permissions, and say so plainly on the application: "Please do not email tax documents — upload them here." Most families follow the instruction when you give them one.
- Name who may see what. Financial aid detail should reach the people deciding awards, not everyone with admissions access. Separate the folders, and check the permissions list against who actually sits on the committee this year.
- Set a retention date and keep it. Decide how long financial documents stay after a decision — your auditor or association may have guidance — then actually delete them on schedule, including the copies in mailboxes and Downloads folders.
- Brief your seasonal helpers. Anyone touching admissions files this season gets ten minutes on handling rules and a school account, not a shared login. When the season ends, their access ends with it.
The part families notice
Add two sentences to your admissions page explaining how financial documents are protected and when they're destroyed. Families comparing schools are handing over their complete financial picture to an institution they're still evaluating — the school that explains its handling looks like the careful one. It costs nothing and it's true.
Before applications arrive in volume, do one thing: search your admissions mailbox for last cycle's attachments and see what's still sitting there. Whatever you find is this season's cleanup list and next season's process change. Our free school IT assessment includes a review of how admissions and financial aid data is stored and who can reach it — findings are yours either way.
You're asking families to trust you with their children. They're also trusting you with their income, their debts, and their Social Security numbers. Handle the second one as deliberately as the first, and admissions season stops being the quiet gap in an otherwise careful school.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →