Fairfax County Public Schools Replaces Dropbox With Files.com for Controlled Student-Records Disclosure

Fairfax County Public Schools is the ninth-largest school division in the United States: 200 schools and centers serving more than 177,000 students in Fairfax County, Virginia. It is also a Virginia public body, which puts it under two records laws at once. The Virginia Freedom of Information Act gives citizens the right to its public records, on a clock of five working days, extendable to twelve. FERPA gives every parent the right to their child's educational records. In a division of 177,000 students, those rights get exercised every day, and the requests land in one place: the Public Records Office, inside the Office of Division Counsel. Nearly every granted request ends the same way, with confidential records leaving the district for exactly one outside person.

FCPS replaced Dropbox with Files.com for a standardized workflow of password-protected, expiring case-folder links; today, the office centrally manages at least a hundred live links at a time.

A Daily Obligation With No Room for Error in Either Direction

Each disclosure is one student's assembled records going to one named recipient: a parent, an attorney, or a special-education advocate. Those recipients share two traits that make the delivery hard. They are outside the district, and they are one-time. You cannot onboard a parent as a system user for a single download, and you cannot ask a family to install software to receive what the law already entitles them to. The only channel the office reliably has for reaching them is email, and anything that travels by email is only as private as the thing waiting at the other end of the link.

The payload is legally protected student data, so the delivery has to hold in both directions at once. The records must actually reach the family, because a link that fails after delivery is a failed disclosure with a statutory deadline behind it. And the records must reach only the family, because a share that opens more than the one case folder puts another student's protected records in the wrong hands.

This is not occasional work. Deliveries go out every day, with volume rising and falling as case timelines cascade, and the same kind of confidential one-to-one delivery runs in other offices across the division that handle sensitive student matters. An operation that frequent cannot rest on per-case judgment.

What Disclosure Required That Link Sharing Didn't Provide

The office had previously run its external delivery on Dropbox share links. What the work actually required was not a sharing feature but a disclosure system, and the requirements describe the gap. Every link had to work in any browser, with no account and nothing installed, for a recipient who will visit once. Every link had to carry its own password, because email carries the link. Every link had to shut itself off on a schedule, expose exactly one case folder and nothing more, and remain visible to the office in one place where it could be verified, changed, or revoked for as long as it lived.

One Case Folder, One Recipient, One Password, 30 Days

On Files.com, every disclosure takes the same shape, and the shape is the control.

For each granted request, the office assembles a case folder holding that one student's records. The isolation rule comes first: sharing permission is granted on the case subfolders themselves, never recursively on the parent folders that hold many students' records. Files.com's folder-level permissions turn that from a habit into a guarantee. The largest thing any link can ever expose is one case folder.

The delivery itself is a Files.com Share Link on that folder. Each link carries its own password, set per recipient, so the security lives on the link rather than on the email that delivers it. Each link expires on the office's standard 30-day window. The recipient needs nothing but a browser: no account, no software, no invitation to a system they will use once.

Every live link the district has issued appears in the site's Links section, giving staff one place to manage disclosures throughout their access windows.

Records Go Out Every Day, and Never to More Than One Person

With every disclosure running through Files.com, the Public Records Office replaced consumer link sharing with a repeatable disclosure pattern. The results follow from the pattern.

• Records reach families every day, through a browser, with nothing to install and no account to create. When a family needs more time, staff reactivate the existing link rather than re-running the delivery.
• Over-disclosure is structurally prevented. A share link can expose one case folder and nothing above it, so no delivery can accidentally open another student's records.
• The office manages its whole population of live links, at least a hundred in circulation at a time, from one screen: verify a link, change its password, extend it, or shut it off.
• The pattern outgrew the office that built it. Four groups in the primary office and three additional offices, including those handling special-education and Title IX matters, now run their confidential deliveries on the same Files.com site.

A Statutory Function That Runs Like a Routine

Today, one of the most legally unforgiving jobs in the district runs as a daily routine. When a request is granted, a records specialist does the same things every time: assemble the case folder, create the Files.com link, set the password and the 30-day window, and send one email. The parent, attorney, or advocate on the other end opens a browser and retrieves the records inside the window the office intended, and the office knows what was shared, with whom, and until when.

FCPS did not make records requests rarer or the deadlines softer. It made every disclosure the same shape: one folder, one recipient, one password, one window. That is what statutory disclosure looks like when it scales — not more people remembering more precautions, but Files.com applying the same ones to every link, every day.