Compliance & Certifications

What It Is: Web Content Accessibility Guidelines (WCAG) 2.1 Level AA is the international standard for digital accessibility. It’s the legal requirement for federally-funded educational technology under Section 508.

What We Meet:

• All content perceivable by users with disabilities (text alternatives, captions, color contrast)
• All functionality operable via keyboard (no mouse required)
• All content understandable (clear language, predictable behavior)
• All content robust (compatible with assistive technologies)

What You Get:

• VPAT (Voluntary Product Accessibility Template) document ready for procurement
• Third-party audit certification from recognized accessibility firm
• “Section 508 Compliant” certification for federal funding applications
• Legal protection against ADA compliance lawsuits

What It Is: Family Educational Rights and Privacy Act (FERPA) protects the privacy of student education records. Schools that violate FERPA risk losing federal funding.

How We Comply:

Accommodation Data Privacy

• Student disability information stored in separate, encrypted database table
• Only authorized teachers can access their own students’ accommodation data
• Parents/guardians receive notification when accommodations are set
• Students (18+) or parents can request full data export or deletion

Audit Logging

• Every access to student records is logged with timestamp and user ID
• Logs retained for 7 years (FERPA standard)
• Immutable logs (cannot be edited or deleted after creation)
• IT administrators can generate audit reports for compliance reviews

Parental Rights

• Parents can view their child’s learning data and accommodations
• Parents can request corrections to inaccurate data
• Parents receive annual notification of data access (FERPA requirement)
• Data deletion requests honored within 30 days

Data Sharing

• No third-party data sharing without explicit consent
• Data Processing Agreements (DPAs) available for district review
• Student data never used for advertising or non-educational purposes

What It Is: Children’s Online Privacy Protection Act (COPPA) requires parental consent before collecting data from children under 13.

How We Comply:

Parental Consent Workflow

• Students under 13 cannot activate accounts without parental approval
• Parent receives email explaining data collection practices
• Parent must click “I Consent” before student can access platform
• Consent tracked and logged for compliance audits

Data Minimization

• We collect only: name, grade level, school/teacher, learning progress, accommodations
• We do NOT collect: home address, phone number, photos, location data
• No behavioral tracking or advertising targeting children

Parental Access

• Parents log into their child’s account using the same credentials
• Parents see the exact same interface as their child (full transparency)
• Parents can view progress, edit accommodations, export data, or delete the account
• System logs parent access timestamps for FERPA audit compliance

What It Is: Individuals with Disabilities Education Act (IDEA) ensures students with disabilities receive free appropriate public education (FAPE).

How We Support IDEA:

• Platform accommodates students with IEPs without separate curriculum
• Teachers can implement IEP accommodations directly in the system
• Accommodation settings travel with student across all lessons
• System generates compliance reports showing accommodation usage
• Qualifies for IDEA federal funding as assistive technology

Simplified Parent Access Model

Parents do not need separate accounts. Instead:

• For students under 13: Parent must provide their email during student registration. Parent receives an activation email and creates the account password. This ensures parental consent before any data collection begins.
• Ongoing access: Parents log into their child’s account using the same username and password. They see exactly what their child sees-no separate interface, no confusion.
• Audit trail: System logs timestamps whenever the account is accessed, allowing districts to verify parental involvement for FERPA compliance.
• For students 13+: Parent email is optional. Students can share credentials with parents if they choose.

This approach is simpler, more secure (one set of credentials instead of two), and fully compliant with COPPA requirements.

OWASP 2025 Security Standards

What It Is: Open Web Application Security Project (OWASP) Top 10 is the industry standard for web application security. We implement all protections against the most critical security risks.

Protections Implemented:

SQL Injection Prevention

• All database queries use parameterized statements (no string concatenation)
• Input validation on all form fields
• Row-Level Security (RLS) ensures users only access their own data

Cross-Site Scripting (XSS) Protection

• All user input sanitized before display
• Content Security Policy (CSP) headers prevent script injection
• Output encoding based on context (HTML, JavaScript, URL)

Cross-Site Request Forgery (CSRF) Protection

• CSRF tokens required on all state-changing operations
• SameSite=Strict cookies prevent cross-site requests
• JWT authentication provides stateless security

Rate Limiting

• Login attempts: 5 per 15 minutes per IP address (prevents brute force)
• Password reset: 3 per hour per email
• API requests: 100 per minute per user
• File uploads: 10 per hour per user

Session Management

• JWT access tokens expire after 1 hour
• Refresh tokens expire after 7 days
• Sessions invalidated immediately on logout
• Concurrent session limits prevent account sharing

Security Headers

• Strict-Transport-Security: max-age=31536000; includeSubDomains
• X-Frame-Options: DENY
• X-Content-Type-Options: nosniff
• Referrer-Policy: strict-origin-when-cross-origin
• Permissions-Policy: geolocation=(), microphone=(), camera=()

Encryption & Data Protection

Encryption at Rest

• Sensitive fields encrypted with AES-256
• Encryption keys managed via secure vault (not in code or config files)
• Includes: IEP documentation URLs, accommodation notes, audit log IP addresses

Encryption in Transit

• All connections use TLS 1.3 (latest standard)
• HTTPS enforced site-wide (no plain HTTP)
• Certificate pinning prevents man-in-the-middle attacks

Database Security

• Row-Level Security (RLS) policies enforce access controls at database level
• Teachers can only query their own students’ data
• Students can only query their own progress
• Admins have read-only access (cannot modify student data)
• All database access logged for auditing

Authentication Standards (NIST 800-63B)

What It Is: National Institute of Standards and Technology (NIST) provides federal authentication standards.

How We Comply:

Password Requirements

• Minimum 8 characters (we recommend passphrases)
• No complexity requirements (NIST discourages “Password123!” style rules)
• Passwords checked against breach databases (Have I Been Pwned API)
• No forced password expiration (NIST recommendation)

Multi-Factor Authentication (MFA)

• Available for teachers and administrators
• SMS codes or authenticator app (TOTP)
• Required for admin accounts with elevated privileges

Account Recovery

• Secure password reset via email token
• Tokens expire after 1 hour
• Old tokens invalidated when new one generated
• No security questions (easily guessed)

Third-Party Security Audits

Annual Penetration Testing

• Ethical hackers test for vulnerabilities
• Includes: SQL injection, XSS, CSRF, session hijacking, privilege escalation
• Results documented and remediated within 30 days
• Audit reports available to districts upon request

Vulnerability Scanning

• Automated scans run weekly
• Critical vulnerabilities patched within 24 hours
• Medium/low vulnerabilities patched within 30 days

Bug Bounty Program (Future)

• Public program via HackerOne or Bugcrowd
• Security researchers paid for finding vulnerabilities
• Demonstrates commitment to ongoing security

Our full security documentation can be found here:
Security Documentation

What Data We Collect

Student Data (Minimal Collection)

• Name and grade level
• School and assigned teacher (if enrolled)
• Learning progress (lessons completed, scores, time spent)
• Accommodation settings (disability flags, IEP details)
• Interest preferences (for content personalization-e.g., “likes soccer”)

What We Do NOT Collect

• Home address or phone number
• Social Security number
• Financial information
• Biometric data (fingerprints, facial recognition)
• Location tracking or browsing history
• Social media data or contacts

How Data Is Used

Educational Purposes Only

• Deliver personalized lessons based on grade level and interests
• Apply accommodations based on IEP requirements
• Track learning progress for teachers and parents
• Generate reports for academic planning

Never Used For

• Advertising or marketing to students
• Selling data to third parties
• Behavioral profiling beyond educational context
• Cross-platform tracking

Data Retention & Deletion

While Account Active

• All learning data retained to support continuous progress tracking
• Accommodation settings persist across school years

After Account Inactive (3 Years)

• System sends deletion notice to student/parent
• If no response, data pseudonymized (name replaced with ID)
• Full purge after 7 years (matches audit log retention requirement)

User-Requested Deletion

• Student (18+) or parent can request deletion anytime
• Data deleted within 30 days of request
• Confirmation email sent when deletion complete
• Audit logs retained (required by law) but student identity removed

Parental Access Rights

How Parents Access: Parents use the same login credentials as their child; no separate parent account needed. For students under 13, parents create the account password during the approval process.

What Parents Can Do

• Log into their child’s account to view learning progress and accommodation settings
• Export their child’s complete data (machine-readable JSON + PDF)
• Request correction of inaccurate information
• Delete their child’s account
• Withdraw consent for data collection (for children under 13)

What Parents Cannot See (Student Privacy)

• Individual answer details (protected by FERPA for ages 13-17)
• Private messages to teachers
• Peer comparison data

For IT Administrators

Technical Requirements

• Modern web browser (Chrome, Firefox, Safari, Edge-last 2 versions)
• Screen reader compatible (JAWS, NVDA, VoiceOver)
• Keyboard and mouse optional (full keyboard navigation available)
• Internet connection (minimum 5 Mbps for video content)

Single Sign-On (SSO) Integration

• Supports SAML 2.0 and OAuth 2.0
• Compatible with Google Workspace, Microsoft 365, Clever, ClassLink
• Automatic account provisioning from student information systems

Rostering Integration

• CSV import for bulk student/teacher enrollment
• OneRoster API support for automated syncing
• Integration with PowerSchool, Infinite Campus, Skyward, etc.

Network Configuration

• No firewall configuration required (standard HTTPS port 443)
• Content hosted on CDN for fast loading
• Optional: IP whitelisting for district security policies

For Teachers

Getting Started (5 Minutes)

1. Log in and see your roster (imported from SIS)
2. Click student name: “Accommodations” tab
3. Set accommodations based on student needs:
• Vision: Toggle screen reader, high contrast, adjust text size
• Hearing: Enable auto-captions, switch to typed responses
• Reading: Select dyslexia-friendly font, adjust line spacing
• Motion: Enable reduced motion for students with sensitivity
• Cognitive: Adjust content complexity, reduce multiple-choice options
4. Click “Save” and you are done!

Ongoing Management (Zero Extra Time)

• Accommodations apply automatically to every lesson
• Students see personalized version without teacher intervention
• Grading interface identical for all students
• System handles all technical adjustments behind the scenes

Professional Development

• Live training webinars (1 hour introduction)
• Video tutorials embedded in platform
• Printable quick-reference guides
• Email support for accommodation questions

For School Administrators

Compliance Monitoring Dashboard

• View accommodation usage across school/district
• Download FERPA audit logs for compliance reviews
• See WCAG 2.1 compliance status in real-time
• Generate reports for IDEA funding applications

Parent Communication Tools

• Automated emails sent to parent email address when accommodations are set
• Annual FERPA notification sent automatically to parent email
• Parents access all features by logging into student’s account (no separate portal)
• Delete requests tracked with confirmation workflow

Procurement Support

• VPAT document ready for RFP responses
• Data Processing Agreement (DPA) template
• Security audit reports available
• SOC 2 Type II certification (in progress)

Common Accommodation Scenarios:

Student with Dyslexia:

• Font: OpenDyslexic or Comic Sans
• Line spacing: 1.5x to 2.0x
• Content complexity: -1 grade level (if appropriate)
• Extended time on assessments

Student with ADHD:

• Reduced motion: ON (eliminates distracting animations)
• Extended time on assessments
• Content complexity: Consider simplification if reading is challenge

Student with Visual Impairment:

• Screen reader optimization: ON
• High contrast mode: ON
• Text size: 150-250%
• Keyboard navigation: Enabled

Student with Autism:

• Reduced motion: ON (reduces sensory overload)
• Consistent layout and predictable navigation (built-in)
• Line spacing: Adjust if visual processing is challenge