This is an evidence mapping, not a legal determination, certification, or state approval. Districts should apply their own legal review.
| Citation | Requirement | How StorylineIQ addresses it | Published controls | Open evidence | Status |
|---|---|---|---|---|---|
| Tex. Educ. Code § 32.151 et seq. (Student Data Privacy)Data ownership & educational purpose | Student data held by a school-service provider remains the property of and under the control of the district, and may be used only for authorized educational purposes. | AC-01 Tenant isolation: Every application table is protected by Row Level Security scoped to the caller's district. AC-02 Role-based access control: Roles live in a dedicated table and are enforced by database policies and server-side checks. DR-01 Student record review and export: An authorized administrator can review and export the StorylineIQ information held about a student. PR-01 Data inventory as an architectural control: Every schema object is classified in a registry that CI enforces for completeness. | AC-01, AC-02, DR-01, PR-01 | None | evidence availableReviewed 2026-08-23 |
| Tex. Educ. Code § 32.153No sale, advertising, or targeted marketing | A provider may not sell student data or use it for targeted advertising or to create a non-educational profile. | AI-04 No advertising, sale, or model training by StorylineIQ: StorylineIQ trains no models and operates no advertising, profiling, or data-sale path. | AI-04 | None | mappedReviewed 2026-08-23 |
| Tex. Educ. Code § 32.154 / FERPA 34 CFR § 99.31(a)(1)School-official / authorized-use posture | The provider acts under the district's direct control as a school official with a legitimate educational interest, with access limited to authorized users. | AC-01 Tenant isolation: Every application table is protected by Row Level Security scoped to the caller's district. AC-02 Role-based access control: Roles live in a dedicated table and are enforced by database policies and server-side checks. AC-04 Account provisioning: Accounts are created by district invitation; open self-signup is disabled. AC-05 Cross-class student context: Cross-class context is district-enabled, view-only, and excluded from exports and packets. | AC-01, AC-02, AC-04, AC-05 | None | evidence availableReviewed 2026-08-23 |
| Tex. Educ. Code § 32.155Data security controls | The provider must maintain reasonable administrative, technical, and physical safeguards for student data. | DP-01 Encryption in transit: All application, database, and provider traffic uses TLS. DP-03 Secrets handling: Secrets are read only inside server handlers from the platform secret store. AC-03 Multi-factor authentication: MFA enrollment is tracked per user and can be enforced district-wide with a grace window. AS-01 Input validation and typing: Server boundaries validate input with Zod under strict TypeScript. AS-02 Dependency management: Dependencies are scanned and vulnerable versions are updated or pinned via overrides. | DP-01, DP-03, AC-03, AS-01, AS-02 | DP-02 — not claimed; open evidence item | partial evidenceReviewed 2026-08-23 |
| Tex. Educ. Code § 32.156Inspection, correction, and parent requests | The provider must support the district in responding to parent requests to review and correct student information. | DR-01 Student record review and export: An authorized administrator can review and export the StorylineIQ information held about a student. AU-03 Export and packet auditability: Student exports and conference packets record generation, rendering, opening, and emailing. | DR-01, AU-03 | DR-02 — not claimed; open evidence item | evidence availableReviewed 2026-08-23 |
| Tex. Educ. Code § 32.157 / district records-retention schedulesRetention and destruction | Student data must be destroyed or returned when no longer needed for the authorized purpose or at contract termination. | RT-01 Configured retention windows: Retention windows are district-configurable and enforced by a scheduled purge. RT-02 District offboarding: District offboarding is a staged workflow in the product: review the classified data surface, produce a checksummed export and retrieve it through a recorded authorized link (or waive it with a reason), hold the tenant read-only for a cancellable grace period, then execute 13 foreign-key-ordered stages behind second-factor and typed confirmation. Completion is refused while any category classified for removal still holds rows. Claims about infrastructure backup purge timing, RPO/RTO, and provider-side deletion are deliberately excluded and remain unverified. DR-03 Controlled deletion: Student deletion runs as a request with an impact inventory, a separate approver, second-factor confirmation at execution, and a record of what was deleted versus anonymized. Anonymization is used wherever a row must remain for audit or aggregate reporting. | RT-01, RT-02, DR-03 | None | partial evidenceReviewed 2026-08-23 |
| Tex. Bus. & Com. Code § 521.053 (breach notification)Incident response and notification | The provider must notify affected parties without unreasonable delay after discovering a breach of sensitive personal information. | IR-01 Incident response: A documented incident response process with a published security contact exists. AU-01 Sensitive-action audit log: Privacy-sensitive actions are recorded in an append-only audit log that users cannot edit or delete. AU-02 Audit record content discipline: Audit rows carry actor, action, tenant, resource identifiers, and outcome — not narrative payloads. | IR-01, AU-01, AU-02 | None | evidence availableReviewed 2026-08-23 |
| Texas records-retention / continuity expectationsData integrity, backup, and recovery | The provider must protect against loss of district data and be able to recover it. | BR-01 — not claimed; open evidence item | review requiredReviewed 2026-08-23 | ||
| Tex. Educ. Code § 32.153 / district AI expectationsAI governance | Automated processing of student data must serve the authorized educational purpose, exclude non-educational profiling, and keep consequential decisions with educators. | AI-01 Approved AI boundary: All model requests are server-side and target the Lovable AI Gateway; no client-side or direct-provider call path exists. AI-02 Identifier redaction before AI transmission: Seven of nine AI features replace names with placeholders before transmission; two declared exceptions transmit raw content and are documented. AI-03 Human confirmation of AI output: AI output is advisory; extracted plan content requires human review and approval before publication. AI-04 No advertising, sale, or model training by StorylineIQ: StorylineIQ trains no models and operates no advertising, profiling, or data-sale path. | AI-01, AI-02, AI-03, AI-04 | None | partial evidenceReviewed 2026-08-23 |
| Tex. Educ. Code § 32.152 (subcontractor obligations)Subprocessors | Subcontractors receiving student data must be bound to equivalent obligations and disclosed. | PR-01 Data inventory as an architectural control: Every schema object is classified in a registry that CI enforces for completeness. | PR-01 | None | partial evidenceReviewed 2026-08-23 |
| COPPA 16 CFR Part 312 (school-authorized use)Under-13 use | Where students under 13 are involved, the provider operates under school authorization for an educational purpose and does not collect data beyond that purpose. | AC-02 Role-based access control: Roles live in a dedicated table and are enforced by database policies and server-side checks. AI-04 No advertising, sale, or model training by StorylineIQ: StorylineIQ trains no models and operates no advertising, profiling, or data-sale path. PR-01 Data inventory as an architectural control: Every schema object is classified in a registry that CI enforces for completeness. | AC-02, AI-04, PR-01 | None | mappedReviewed 2026-08-23 |
Notes
- Tex. Educ. Code § 32.151 et seq. (Student Data Privacy) — Every data category records its educational purpose and authoritative system.
- Tex. Educ. Code § 32.153 — No advertising, ad-network, or data-sale integration exists in the product.
- Tex. Educ. Code § 32.155 — Encryption-at-rest and platform safeguards rest on provider attestations (DP-02).
- Tex. Educ. Code § 32.156 — Requests are handled through the district; StorylineIQ provides administrator tooling.
- Tex. Educ. Code § 32.157 / district records-retention schedules — Retention purge exists; district offboarding and controlled deletion workflows are pending (RT-02, DR-03).
- Texas records-retention / continuity expectations — Backup cadence, retention, PITR, RPO/RTO, and restore testing are EVIDENCE REQUIRED.
- Tex. Educ. Code § 32.153 / district AI expectations — Provider training-exclusion and retention assertions remain EXTERNAL EVIDENCE REQUIRED.
- Tex. Educ. Code § 32.152 (subcontractor obligations) — Register reconciled 2026-08-23; published list needs the corrections listed as discrepancies.
- COPPA 16 CFR Part 312 (school-authorized use) — Students never hold accounts; all entry is educator-initiated.
Evidence last reviewed 2026-08-24. Verification strength per control is in the control evidence matrix.