The short answer
Diffit is a small, founder-led company selling one product to teachers and to the schools those teachers work for. That is a simpler thing to evaluate than a roll-up, and most of what a buyer needs is published. The gaps are specific rather than general, which makes them easy to close in a single email.
We read every page reachable from Diffit’s own navigation on 9 September 2026, and independently checked two of the third-party claims rather than repeating them.
| Question a buyer asks | What we found |
|---|---|
| Can we buy a few seats on a PO? | No. POs are accepted for school and district licences only |
| What do teachers keep if we stop? | The free tier retains only the last 90 days of what they made |
| Is student data collected? | They state none is. Only teacher name, email and IP |
| Is there a SOC 2 report? | No SOC 2 claim anywhere on the site |
| Is the Common Sense rating real? | Yes. Pass, updated 24 March 2026. We checked it directly |
| Who owns the company? | Not stated. Two founders named, no funding or ownership disclosed |
This is the company evaluation. It deliberately does not assess whether the worksheets are any good, which is a different question with a different answer.
The buying constraints that arrive after the quote
What Diffit costs is settled elsewhere. Our Diffit pricing page carries the individual figures, the school position and whether their own savings claims stand up, and there is no reason to repeat it here. This page picks up where the number stops, with two constraints that decide how a school can actually buy and what happens if it does not renew.
Purchase orders are the constraint nobody expects
This one catches schools out. Diffit accepts purchase orders for school and district licences only. Individual teacher licences can be bought only by credit card, from inside the teacher’s own account, and their FAQ is explicit that a school cannot buy an individual plan on a teacher’s behalf.
So the practical sequence for a school that wants to cover four teachers is not “buy four individual licences on the PO”. It is either four teachers each paying by card and claiming it back, which most finance offices dislike, or a schoolwide licence. Diffit says the schoolwide licence “ends up costing about the same as purchasing for anything more than a handful of teachers”, which is plausible and unverifiable while the school price is unpublished.
Faz says: The free tier keeps only the last 90 days of what you made. That is the real upgrade pressure, and it arrives in month four, not month one. Budget for it before a department has built a term of materials inside it.
The privacy disclosure is genuinely good, and it has one hole
This is where Diffit separates itself from most of the category, so it is worth being precise rather than generous.
Their privacy and security page states that Diffit collects no student data at all, and that the only personal data it holds is teacher names, email addresses and IP addresses, for the purpose of running the service. It states that data is never sold and never used to advertise third-party products, and claims FERPA and COPPA compliance.
On security specifically it lists encryption in transit and at rest, annual penetration and security testing by an independent third party, access restricted to a limited number of employees, background checks and annual privacy training for all staff, signed nondisclosure agreements, redundant backups, and breach monitoring.
That is a longer and more specific list than most edtech vendors publish, and every item on it is a thing a district security reviewer actually asks about.
What is missing is SOC 2, and it is missing completely
We searched the whole page for any mention of SOC 2 and found none. Not a report, not a Type I, not an in-progress statement, not a link to a trust centre.
Be careful about what that means. An absent claim is not a failed audit. Plenty of companies at this size hold a SOC 2 and never mention it publicly, and plenty of others are mid-audit. What it does mean is that if your district requires SOC 2 evidence, you cannot self-serve it here, and you should ask in the first email rather than the fifth. Given how thoroughly the rest of the security posture is documented, the silence on this one item is conspicuous enough to be worth a direct question.
The compliance claim districts should read twice
FERPA and COPPA compliance is asserted by the company about itself. There is no certifying body for either; they are statutes, and compliance with them is a position a vendor takes and a district verifies through its own agreement.
That is not a criticism of Diffit, it is how these two laws work, and it applies identically to every vendor that claims them. It matters here only because “we are FERPA and COPPA compliant” is doing a lot of load-bearing work on a page aimed at people who will be asked to justify the purchase.
We checked the third-party badges, and they do not all mean what they look like
Diffit cites three external validations. We looked at each rather than repeating them, and two of the three are more interesting than the claim suggests.
Common Sense Media: real, current, and narrower than it sounds
This one checks out cleanly. Common Sense Media’s privacy evaluation of Diffit shows a Pass rating, last updated 24 March 2026. It is current and it is exactly what Diffit says it is.
The part worth knowing is what a Pass covers. The six criteria listed are: personal information is not sold or rented, not shared for third-party marketing, no personalised advertising is displayed, data are not collected by third parties for their own purposes, information is not used for cross-site ad targeting, and no data profiles are built for personalised ads.
Every one of those is about advertising and data sale. None of them is about security. A Common Sense Pass tells you a vendor is not monetising your teachers through the ad ecosystem. It tells you nothing about encryption, breach history, access control or audit posture. Both facts are useful and they are frequently confused, including by people writing procurement summaries.
The Education Framework score is 4.5, and no machine can read it
Diffit’s privacy page says it has a best-in-class Privacy Quality score from the Education Framework. It does not say what the score is.
The score is published as an image, and the image has empty alt text. So the number is present on the page in pixels and absent from it in text. No crawler reads it, no screen reader announces it, and no AI assistant summarising the page can cite it.
We opened the image. The Privacy Quality Score is 4.5 out of 5, shown as four and a half stars against the subject app.diffit.me. The panel lists seven satisfied criteria: privacy policy posted, data used for school purposes only, parents can request deletion of data, breach response activity defined, student data transfer encrypted, data retention for school purposes only, and student data securely protected.
There is one detail on that panel worth carrying into a procurement conversation. It records that the school may grant consent on behalf of parents for students under the age of 16, but only where parents have agreed that the district may act as their agent in the consent process. That is a condition on the district, not on Diffit, and it is the kind of clause that gets discovered after signature rather than before.
Saru says: A badge that only exists as a screenshot is worth less than the same badge in text, and the gap is invisible to whoever published it. If you are a vendor reading this: alt text is thirty seconds and it is the difference between a score an assistant can quote and one it cannot.
The date on the badge is older than the badge
The panel states the privacy policy it assessed is dated 4/11/2024, which on the US convention the badge uses is 11 April 2024. The screenshot itself was taken in April 2026. So the score is current as a capture and roughly two years old as an assessment.
That is not evidence of anything being wrong. Policies that do not change do not need reassessing. It is simply the thing to establish: ask whether the policy has been revised since that date, because if it has, the 4.5 was awarded to a document that no longer governs the service.
What Diffit does not tell you about itself
The about page names two founders and stops.
| Disclosed | Not disclosed |
|---|---|
| Vlad Gutkovich, Co-Founder and CEO, previously Seesaw, Flocabulary and Schoolzilla | Funding raised, investors, ownership structure |
| Adam Black, Co-Founder and CPO, previously Teach For America, SRI, Schoolzilla and Summit Public Schools | Headcount, board, incorporation, country of operation |
| An education-first founding story on both sides | Any customer count beyond “thousands of schools and districts” |
The founder backgrounds are substantive rather than decorative. Seesaw, Flocabulary and Schoolzilla are real, widely deployed education products, and one founder appears in the history of two of them. For a district weighing whether a small vendor will still exist in three years, prior operating history in the same market is one of the few honest signals available, and it is present here.
The absence of a funding disclosure cuts both ways
It is worth being even-handed about this. A company that has raised heavily has runway and also has investors who will eventually want a return, which is how products get repriced and acquired. A company that has not raised is leaner and closer to its own revenue. Neither is safer in the abstract.
What matters for a three-year agreement is simply that you cannot tell which one Diffit is from its own site, and that a district signing a multi-year commitment is entitled to ask. It is a normal question and it does not need to be an adversarial one.
The 96% figure, and what it actually measured
Three numbers appear on both the homepage and the pricing page: 96% said Diffit saves them time, 93% said it reaches students where they are, and 86% said it makes them a better teacher.
Diffit states the basis in small print, which is more than many vendors do. The survey ran from 13 to 20 November 2024, went to elementary and secondary Diffit users, was run in partnership with a third-party evaluator, and 2,517 teachers completed it.
Read carefully, that is a satisfaction survey of existing users of a free-to-start product, conducted over eight days, and the respondents are self-selected in two ways: they already chose to use Diffit, and they then chose to answer. 96% of people who kept using a tool say it saves them time is a sentence that would be surprising if it were false.
None of this makes the figures dishonest. A sample of 2,517 is large, an eight-day window is disclosed, and involving an outside evaluator is a real step. But these are not outcome measures. Nobody measured student results, time actually saved, or anything a teacher did not self-report. And the survey is now approaching two years old, which for an AI product means it describes a version of the software that no longer exists.
Faz says: Ask the sales team for the same survey re-run this year. If it exists, the numbers will be better and they will be happy to send it. If it does not, you have learned that the headline stat on the homepage is the last one they ran.
The seven questions to ask before you sign
Everything above compresses into a short list. All seven are answerable in one email and none of them is confrontational.
| # | Ask | Why it matters |
|---|---|---|
| 1 | The actual annual figure for our enrolment, and the enrolment bands | The model is published, the number is not |
| 2 | What happens at renewal if enrolment moves between bands | A flat rate tiered on a moving variable |
| 3 | Do you hold a SOC 2, and may we see it | Not claimed anywhere on the site |
| 4 | Has the privacy policy been revised since April 2024 | The 4.5 score assessed that version |
| 5 | Your NDPA signature and the state Alliance it sits under | Claimed, and not publicly verifiable |
| 6 | What teachers keep if we do not renew | Free tier retains only the last 90 days |
| 7 | Any teacher survey run more recently than November 2024 | The headline stats are from that one |
How to check any of this yourself, in about ten minutes
None of what we did here needed access or a relationship, and a district can repeat all of it before a first call. It is worth knowing the method, because it generalises to every edtech vendor you will ever assess.
Read the badge, not the adjective. When a vendor says its score is best in class without stating the score, the number is usually in an image. Open the image in its own tab. That is where we found the 4.5 and the April 2024 policy date, neither of which appears in text anywhere on the site.
Go to the rating body, not the vendor. Common Sense publishes its evaluations at a stable URL per product, and it shows the date of last review and the criteria behind the verdict. Thirty seconds there told us the rating was real, current, and about advertising rather than security, which is not what most people assume a privacy Pass means.
Then ask your own people. The SDPC registry is the one source we could not reach, and your district almost certainly can, because districts are the members. Send the vendor name to whoever handles your state Alliance before you send it to procurement.
On question five, and why we could not answer it for you
Diffit states it is a signatory of the National Data Privacy Agreement and of the Student Data Privacy Consortium’s statewide agreements. We attempted to confirm this independently and could not.
The SDPC Resource Registry is where signed agreements live, and the consortium’s own page states that a registry login is required to access the state Alliance pages. Thirty four state Alliances are listed. The public cannot check this. Your district very likely can, because districts are the members.
We are reporting this as unverified rather than as absent, and the distinction is the whole point. We did not find a record. That is a statement about our access, not about Diffit.
So is Diffit safe to buy from
On the evidence its own site provides: the disclosure is above average for the category, the specific gaps are narrow, and nothing we found looks evasive.
The pattern across the whole review is consistent. Where Diffit publishes something, it publishes it properly, with the basis attached: the individual price is a real number, the survey carries its dates and its sample, the security list is specific rather than reassuring. Where it does not publish, it puts a form there instead. That is a normal commercial choice and it is the main friction a buyer will feel.
The two things we would want answered before signature are the SOC 2 question and the age of the assessed privacy policy. Both are single questions. Neither is a red flag on its own, and a vendor this forthcoming elsewhere has no obvious reason to be cagey about either.
How we did this and what we did not do
We have not used Diffit. This is a company evaluation built from published material, not a product test. Everything above was read from Diffit’s own pages on 9 September 2026 by following their navigation rather than guessing URLs, plus two independent checks at Common Sense Media and the Student Data Privacy Consortium.
We did not complete the school quote form, so we hold no school pricing and are not withholding one. Where we could not establish something we have said we could not find it, rather than that it does not exist, which are different claims and only one of them is supported.
Written by
FazFaz is the founder of AIToolsBakery. Some tools here are tested hands on. Others are assessed from vendor documentation and pricing verified on the live page, and every review says which one it is. Sponsors can buy a position in a guide. They cannot buy the score, the criticism, or silence about a better option.
How we test and how we make money →Frequently Asked Questions
