Security principles
- Least-privilege access
- Role-based permissions
- School and district data separation
- Audit logging
- Secure authentication
- Encrypted transmission
Access controls
Every user is scoped to their school, district, and role. The platform enforces these scopes at the database layer, not just in the UI.
- Teacher access — limited to classrooms they are explicitly assigned to. Teachers cannot see students, notes, behavior data, or support plans from other classrooms.
- School administrator access — limited to their school. School admins can manage classrooms, teachers, and students inside their school only.
- District administrator access — district-wide visibility and configuration, including retention policies, user invitations, and parent-amendment review.
Access across organizations
Some districts work with a special education cooperative or shared services arrangement. Access between two organizations is always explicit, recorded, and revocable — never implied by a relationship.
- District approval is required — a cooperative's request to work with a district grants nothing until a district administrator approves it, and the district can end it at any time.
- No roster-wide visibility — approving a cooperative does not expose a district's roster. Each student is shared individually, and access ends when that sharing ends.
- Cooperative-owned records stay separate — records a cooperative keeps for students at districts that do not use StorylineIQ belong to the cooperative, and are never mixed with a district's own records.
- Classroom teacher access is narrow — a teacher working with a cooperative sees only the students and documentation requests shared with them, and cannot record implementation evidence.
- Links sent for one task expire — a secure upload link covers a single documentation request, expires, can be revoked, and is stored only as a one-way hash.
Audit logging
The platform records security-relevant activities, including:
- Administrative actions (invitations, role changes, deletions)
- Student record exports and parent-amendment events
- Report access and AI insight generation
- Authentication events
Data protection
- Encryption in transit — all client and service-to-service traffic uses TLS 1.2+.
- Secure storage — data is encrypted at rest by the managed database provider.
- Backups — automated point-in-time backups are retained by our infrastructure provider.
- Access restrictions — production access is limited to a small set of named operators with multi-factor authentication and audit logging.
Multi-factor authentication for admins
District and school administrators are required to enroll a second factor before accessing administrative functions.
What we do not publish
We do not publish sensitive implementation details (specific infrastructure topology, secret rotation schedules, vendor-specific controls) on this page. Districts requiring this level of detail should request our security review through the Data Processing Agreement process.