StorylineIQ publishes a control only when a verification basis exists. 31 controls are published here; 26 are backed by automated tests that run on every change. Controls without a verification basis are not published as capabilities — they appear in the open evidence list below instead.
What the verification labels mean
- VERIFIED IN CODE — Enforced by application code in this repository and covered by automated tests that run in CI.
- VERIFIED BY CONFIGURATION — Enforced by a setting StorylineIQ owns and can re-read on demand; not provable by code alone.
- VERIFIED BY EXTERNAL EVIDENCE — Confirmed by written third-party or platform evidence held on file.
- DOCUMENTED — A written process or decision exists. No automated test or external attestation supports it yet.
- EVIDENCE REQUIRED — The claim cannot be substantiated yet. It is never published as a capability statement.
Review areas
| Area | Position | Published controls | Open evidence |
|---|---|---|---|
| Data Privacy | STRONG | AC-05, AC-07, AI-01, AI-02, AI-03, AI-04, DR-01, DR-03, PR-01, PR-02, RT-01 | DR-02 — not claimed; open evidence item |
| Data Access / Rights | STRONG | AC-03, AC-07, AU-01, AU-03, DR-01, DR-03 | DR-02 — not claimed; open evidence item |
| Data Security | STRONG WITH EVIDENCE GAP | AC-01, AC-02, AC-03, AC-07, AI-01, AI-05, AU-01, AU-02, AU-03, AU-04, AU-05, DP-01, DP-03, DR-03, IR-01, RT-02 | DP-02 — not claimed; open evidence item |
| Data Integrity / Recovery | NEEDS REMEDIATION | AC-01 | BR-01, BR-02, BR-03 — not claimed; open evidence item |
| Data Retention | STRONG | AU-02, DR-03, RT-01, RT-02 | DR-02 — not claimed; open evidence item |
These review areas are StorylineIQ’s own mapping. StorylineIQ has not been rated, reviewed, or certified by EdPrivacy or any other assessor.
Published controls
| ID | Control | Objective | Verification | Reviewed |
|---|---|---|---|---|
| AC-01 | Tenant isolation | A user authenticated in one district can never read or write another district's records. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| AC-02 | Role-based access control | Authorization is decided by role in the database, not by hiding interface elements. | VERIFIED IN CODE3 automated checks | 2026-08-24 |
| AC-03 | Multi-factor authentication | A district can require a second authentication factor for all of its staff accounts. | VERIFIED IN CODE3 automated checks | 2026-08-24 |
| AC-04 | Account provisioning | Only people the district invites can obtain an account. | VERIFIED BY CONFIGURATION2 automated checks | 2026-08-24 |
| AC-05 | Cross-class student context | Educators who share a student can see context without gaining a broader data grant. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| AC-06 | Session controls | An unattended session in a classroom does not stay open indefinitely. | VERIFIED BY CONFIGURATION1 automated check | 2026-08-24 |
| AC-07 | Privileged and administrative access | Elevated database access is never reachable from the browser or from ordinary reads. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| DP-01 | Encryption in transit | District data is never transmitted over an unencrypted channel. | VERIFIED BY CONFIGURATION | 2026-08-24 |
| DP-03 | Secrets handling | Credentials and API keys never reach the browser or the repository. | VERIFIED IN CODE1 automated check | 2026-08-24 |
| DP-04 | Practice-data segregation | Training/practice activity can never contaminate a district's real records or reports. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| DP-05 | Uploaded document containment | Plan documents and roster files are never publicly reachable. | VERIFIED BY CONFIGURATION1 automated check | 2026-08-24 |
| AI-01 | Approved AI boundary | Every model request leaves the product through one reviewable server-side path. | VERIFIED IN CODE | 2026-08-24 |
| AI-02 | Identifier redaction before AI transmission | Direct student identifiers are removed before documentation is sent for summarization. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| AI-03 | Human confirmation of AI output | AI output never becomes a record or a decision without an educator acting on it. | VERIFIED IN CODE3 automated checks | 2026-08-24 |
| AI-04 | No advertising, sale, or model training by StorylineIQ | Student data is used only for the district's educational purpose. | DOCUMENTED | 2026-08-24 |
| AI-05 | Telemetry sanitation | Diagnostic and analytics signals do not carry student content. | VERIFIED IN CODE1 automated check | 2026-08-24 |
| AU-01 | Sensitive-action audit log | A district can reconstruct who did what to a student record and when. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| AU-02 | Audit record content discipline | Audit records are useful for review without becoming a second copy of student content. | VERIFIED IN CODE1 automated check | 2026-08-24 |
| AU-03 | Export and packet auditability | Any assembly of a student's record into a portable document is traceable. | VERIFIED IN CODE1 automated check | 2026-08-24 |
| AU-04 | Cross-class access auditability | Viewing a student outside your own class is visible to district reviewers. | VERIFIED IN CODE1 automated check | 2026-08-24 |
| AU-05 | Administrative change auditability | Changes to who can see what are reviewable after the fact. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| DR-01 | Student record review and export | A district can answer a parent inspection request without engineering help. | DOCUMENTED1 automated check | 2026-08-24 |
| DR-03 | Controlled deletion | Destructive removal is authorized, scoped, and auditable — never ad hoc. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| RT-01 | Configured retention windows | Data is not kept longer than the district's chosen window. | VERIFIED BY CONFIGURATION1 automated check | 2026-08-24 |
| RT-02 | District offboarding | A district that leaves gets its data out and then out of production. | VERIFIED IN CODE5 automated checks | 2026-08-24 |
| AS-01 | Input validation and typing | Untrusted input cannot reach data access unvalidated. | VERIFIED IN CODE2 automated checks | 2026-08-24 |
| AS-02 | Dependency management | Known-vulnerable dependencies do not stay in the product. | DOCUMENTED | 2026-08-24 |
| IR-01 | Incident response | Districts know how an incident is handled and how to reach us. | DOCUMENTED | 2026-08-24 |
| PR-01 | Data inventory as an architectural control | No new data source can enter the product unclassified. | VERIFIED IN CODE1 automated check | 2026-08-24 |
| PR-02 | Subprocessor register | The published subprocessor list matches the services that actually receive data. | VERIFIED IN CODE1 automated check | 2026-08-24 |
| PR-03 | Accessibility practice | Educators using assistive technology can complete core workflows. | DOCUMENTED2 automated checks | 2026-08-24 |
Open evidence items
These controls are owned by the managed hosting platform rather than by StorylineIQ application code. StorylineIQ has requested written confirmation and makes no public claim until it is on file.
- BR-01 Backups — Confirmation that automated database backups run, with cadence, retention period, storage region, encryption, and whether object storage is covered. No public claim is made for BR-01. The Trust Center and procurement packet state the gap instead.
- BR-02 Restore procedure and testing — Point-in-time recovery availability and window, the self-service restore path, expected restore duration, and whether storage can be restored to a point in time. BR-02 is published only as a documented process; no quantitative figure is claimed.
- BR-03 RPO / RTO — Stated recovery point objective, recovery time objective, uptime commitment, and incident-notification commitment, plus whether these are contractual. No public claim is made for BR-03. The Trust Center and procurement packet state the gap instead.
- DP-02 Encryption at rest — Written confirmation that database volumes, object storage, and backups are encrypted at rest, with cipher, key custody, and rotation practice. No public claim is made for DP-02. The Trust Center and procurement packet state the gap instead.
Evidence last reviewed 2026-08-24. See the procurement packet for the full narrative responses and the state readiness mapping for Texas requirements.