Security
Your evidence, under your control
Accreditation files include CVs, student work, and internal deliberations. This page says plainly how that content is handled and where we are still building.
How we handle your content
Encrypted in transit and at rest
Traffic runs over TLS. Stored documents and database contents are encrypted at rest by the hosting provider using managed keys.
Access scoped by role
Faculty reach only their own record. Chairs and administrators reach the cycles they are assigned to. Reviewers reach only what you deliberately share.
Every action attributed
Uploads, replacements, mappings, overrides, and approvals are recorded with the person and the timestamp. The audit trail is part of the product, not an add on.
Export without asking
You can pull the full evidence set, its metadata, and your drafts at any time. Leaving does not require a support ticket.
Least privilege internally
Our team does not browse customer content. Access to production data requires an explicit, logged, time limited grant tied to a support request you raised.
Deletion that actually deletes
When you delete a cycle or close an account, content is removed from active systems and ages out of backups on a fixed schedule we will state in writing.
What we will not claim
Plenty of vendors put certification badges on this page before the audit is finished. We are not going to do that. If a control is in place, it is described above. If it is on the roadmap, we will tell you the date we are working toward.
Send your security questionnaire to the address on the contact page and you will get a direct answer to every line, including the ones where the answer is no.
Questions we get asked
In managed cloud infrastructure in the United States. If your institution requires a specific region or a dedicated environment, tell us during procurement and we will confirm in writing what we can and cannot support.
Not yet. We would rather say that plainly than imply otherwise. Ask us where we are in the process and we will show you the current state, the timeline, and the controls already in place.
Accreditation evidence sometimes includes student work samples. Where it does, treat it as covered by FERPA. We will sign a data agreement that reflects that, and we recommend redacting identifiers on samples wherever the standard does not require them.
No. Your evidence is used to answer your questions inside your own workspace. It is not used to train shared models and it is not shared across institutions.
Yes, on the institution tier. SAML and OIDC against your identity provider.
Send us your questionnaire. We answer it directly rather than pointing at a portal, and we will tell you where the honest answer is not yet.
Send us your questionnaire
We answer security reviews in full, including the items we have not finished yet.