Security and Compliance Documentation

Reviewing a new vendor normally means emailing for a HECVAT, waiting a week, signing an NDA, and sitting through a sales call to get documents that should have been public. This page skips all of that. Everything your information security office, accessibility coordinator and procurement office need is below, in full, at no cost, with no form.

The documents

Read this part first

The platform is open now, in beta, and remaining capabilities roll out on a published roadmap. These documents describe the system as designed and as built, not as independently audited in production. That distinction matters to a reviewer, so we are stating it at the top rather than burying it.

Every answer is either a description of an architectural decision already made and implemented, or an explicit commitment we are willing to be held to contractually. Where we do not have something, the document says so plainly instead of using language engineered to imply we do. We re-issue all of these against the running system as it ships, and the effective date on each page tells you which version you are reading.

Security reviews we have run

These are internal reviews, not independent ones. We publish them, including what they found, because "we review our own security" is worth almost nothing as an assurance and quite a lot as a dated record with findings attached. An institution can judge the rigour for itself rather than taking our word for it.

2026-07-28 — platform security review

Scope: cross-tenant isolation, the public demonstration account, student account provisioning, SAML and OpenID Connect handling, assessment link tokens, and the AI narrative path.

One high-severity finding, fixed the same day. Our demonstration account's containment was keyed to the institution subdomain. The demo signs a visitor in on our main application host, where no institution is bound, so a visitor who navigated back to the team-invitation page there reached a live form with live mail delivery, and could have sent mail from our domain to any address they chose. Fixed in two places: containment now follows the signed-in account rather than the hostname, and institution pages are no longer served on the main host at all. Two regression tests cover it.

One low-severity finding, fixed. A comment in the mail guard claimed five domain suffixes were reserved by RFC 2606 and RFC 6761. Four are. .demo is a real top-level domain delegated in 2015. The guard was correct; the stated reason was not, and would have misled the next person to read it.

One concern investigated and dismissed with a measurement rather than an assumption: the demo rebuild runs inside a web request against a thirty-second limit, and was measured on production at 1.07 seconds.

Verified sound in the same pass: tenant isolation at every point where scoping is deliberately bypassed, SAML assertions required to be signed and verified against the institution's own certificate, OpenID Connect tokens verified against the issuer's published keys with issuer, audience and nonce all checked, assessment tokens stored and compared as SHA-256 hashes, role assignment never taken from user input, and AI spend capped before any request is made.

At the time of this review the platform had 208 automated tests covering these paths.

What we do not have

Repeated here because it is the fastest way for you to decide whether to keep reading:

• No SOC 2 Type II report. The audit costs more than this product's entire budget.

If your process makes SOC 2 a hard gate, we will not clear it today.

• No ISO 27001 certification.
• No independent penetration test yet. We said this would happen before launch. It has

not, and we opened signups anyway, so the honest position is that it is booked work rather than completed work. The summary letter will be posted here when it exists. Our security posture is self-assessed until then, and the section below shows exactly what that self-assessment consists of, including what it found.

• No cyber liability insurance. If your contract requires a certificate of insurance

naming your institution, we cannot currently provide one.

• No dedicated, separately staffed security team. Security responsibilities sit with

the engineering lead who operates the platform.

Any of those may be disqualifying for you, and that is a legitimate decision. We would rather you reach it in ten minutes from a public page than in week three of a review.

What we do have

• Multi-tenant isolation enforced at the framework level and covered by automated tests,

so an unscoped query fails rather than quietly returning another institution's records.

• Encryption in transit (TLS 1.2+) and at rest, with sensitive fields additionally

encrypted at the application layer.

• Append-only audit logging that institutional administrators can read for their own

institution, so a FERPA access review is answerable with evidence.

• Optional campus SSO via SAML 2.0 and OpenID Connect, and it can be set to required.
• All data stored in the United States.
• An AI provider agreement that prohibits training on submitted content.
• A written 72-hour incident notification commitment.
• Contractual acceptance of the FERPA school-official obligations and GDPR processor

duties, pre-agreed and ready to sign.

If you need something else

Ask, and we will publish it here rather than send it privately, so the next institution does not have to ask.

That includes the official EDUCAUSE HECVAT 4.1.5 workbook: request it and we will complete and sign it, allowing about a week for the first one. A pre-completed downloadable copy is not yet on this page.

[email protected]