I don't know precisely, but if FERPA works the way HIPAA does, there's a carve-out for arrangements like this provided that the vendor has an agreement in place (a BAA in HIPAA-speak) and agrees to abide by certain security standards. Note that, in practice, it goes like this:

VENDOR: We promise that we are doing all of the stuff that the law says we're supposed to do to protect the covered data that you're sending us. Look, see the pretty pictures of a fancy data center in our marketing materials?

CUSTOMER: OK, that's good enough for us! (checks off box on list)