Sensitive-record read auditing
Reads — not just mutations — of sensitive records are logged: opening a student profile, revealing help-request contact details, bulk exports, and every consented break-glass read. A quarterly reconciliation confirms no unaudited read path exists.
Standards mappings
This control maps to the following standards and frameworks. Each entry states our real relationship with the standard, and the specific requirements this control helps satisfy.
ISO/IEC 27001:2022InfoSec complianceSelf-assessed
A full 93-control Annex A Statement of Applicability is maintained and honestly dispositioned, and the ISMS went live on 26 July 2026 with its first completed management review. Not certified: no external audit has occurred, the clause 9.2 internal audit is openly unmet, and the certification trigger (a named tender, funding, or first hire) was formally decided at the first management review.
- A.8.15Logging
HECVAT (Higher Education Community Vendor Assessment Toolkit)Higher educationSelf-assessed
A full HECVAT answer pack is maintained and kept current for university procurement, deliberately honest about gaps (no SOC 2 or ISO attestation, no independent penetration test, PITR not enabled). It is a vendor self-assessment, not an externally validated response, backed by a full internal HECVAT-aligned self-audit.
- AuditAudited access to institutional data
FERPA (US Family Educational Rights and Privacy Act)PrivacyAligned
For US-institution contexts, the platform addresses FERPA expectations through verifiable controls — tenant isolation, the append-only audit log behind record-access accountability, erasure, and a breach-notification path — rather than asserting a compliance label. The position is self-assessed as partial, with the audit-trail erasure carve-out disclosed as a live residual. A control you can verify is worth more than a label.
Policy mapping
The written standard this control enforces:
Request access and we can share the full policy set, assessment reports, and completed questionnaires under NDA — or answer your security questionnaire directly.