StorylineIQ documents behavior, special-education support, and accommodation delivery for K-12 districts, with district-controlled data, database-enforced isolation, and AI that assists rather than decides.
At a glance
| Product | K-12 behavior, support-plan, and accommodation documentation |
|---|---|
| Data owner | The district. StorylineIQ processes it on the district's direction. |
| Isolation | Row Level Security scoped to the caller's district on every application table |
| Authorization | Roles in a dedicated table, enforced in the database |
| AI | 12 registered features behind one server-side gateway; names replaced with placeholders; no AI decisions |
| Student rights | Administrator-run review, export, and controlled deletion |
| Retention | District-configured windows with a scheduled purge |
| Departure | Export-first 13-stage offboarding with post-execution verification |
| Subprocessors | 7, published and reconciled in CI |
| Encryption | TLS in transit; at-rest confirmation is an open evidence item |
| Open evidence items | BR-01, BR-02, BR-03, DP-02 |
| Agreement | Standard DPA available; district agreements reviewed |
Review areas
| Area | Position | Summary |
|---|---|---|
| Data Privacy | STRONG | StorylineIQ processes student information only to deliver the educational service the district directs, under the district's control. |
| Data Access / Rights | STRONG | Districts can review, export, and request controlled deletion of a student's StorylineIQ record without a support ticket. |
| Data Security | STRONG WITH EVIDENCE GAP | Isolation and authorization are enforced in the database, not in the interface, and privileged operations are audited. |
| Data Integrity / Recovery | NEEDS REMEDIATION | Schema and application state are reproducible; managed backup and recovery facts are the platform's to evidence, and most remain unevidenced. |
| Data Retention | STRONG | Retention is district-configured, deletion is classified per table, and district departure is a staged, verified workflow. |
These are StorylineIQ’s own review areas. They are not a third-party assessment, score, or certification.
What we do not claim
- StorylineIQ has not been certified, rated, or reviewed by EdPrivacy, SOC 2, ISO, or any other assessor, and makes no such claim.
- Encryption at rest, backup cadence and retention, point-in-time recovery, and RPO/RTO are managed-platform facts that StorylineIQ has requested in writing and does not claim until evidence is on file.
- This packet is an evidence summary, not a legal opinion or a contractual commitment. Contractual terms live in the executed agreement.
Evidence last reviewed 2026-08-24. Detailed verification for every published control is in the control evidence matrix.