Legal
Security
Plain-language overview for faculty and campus IT. Last updated October 26, 2026.
Education records
SOL processes coursework as education records under FERPA when used by an institution. Rosters, attempts, scores, grading rationale, and discussion transcripts are role-gated. Privileged actions write to an append-only audit log.
AI and student text
Short-answer grading and course tutors may send minimized student text and rubric context to an AI subprocessor. Production configuration requires training on customer content disabled and Zero Data Retention (or the strongest no-retention option). Application code does not put student names, emails, or Clerk IDs in prompts.
Scores are computed in application code from rubric criterion matches. Model output alone is not trusted as a raw numeric grade. Low-confidence answers wait for instructor review.
HECVAT
A HECVAT Lite vendor response is maintained for institutional review. Request the current packet during contracting. Supporting policies cover retention, incident response, subprocessors, and a FERPA rider template.
Hosting
The application runs on Vercel. Primary datastore is Neon Postgres on AWS. Authentication is Clerk. Details and subprocessors are listed in the compliance packet shared with IT.
