Trust and compliance

What we can show youbefore you sign.

Every artifact a procurement or security review asks for, with its real status and date. Nothing on this page is rounded up: where a document is still in preparation, it says so.

✦ Last updated 2026-09-17

Artifact register ↓AI governance ↓How to obtain ↓

Artifact register

Nine artifacts, four honest statuses.

Published is on this page. Available on request and under NDA are in hand today. In preparation means exactly that.

Compliance artifacts with status, date, and how to obtain each one.
Artifact	Status	Date	How to obtain
SOC 2 Type II report A bridge letter or successor report will be provided before the report is twelve months old.	Available under NDA	DateReport dated December 31, 2025	ObtainEmail support@aristai.io; an NDA is exchanged first.
HECVAT 4 (full) Includes the AI/ML domain and the accessibility tab.	Available on request	DateCompleted 2026	ObtainEmail support@aristai.io.
Cyber-liability insurance Certificate of insurance issued on request.	Available on request	DateIn force 2026	ObtainEmail support@aristai.io for the certificate.
Accessibility Conformance Report (WCAG 2.1 AA) Written with dated remediation. Rows that only partially support a criterion will be stated as such, not rounded up.	In preparation	DateTarget WCAG 2.1 AA	ObtainEmail support@aristai.io and you will receive it when it is issued.
Data Processing Agreement (vendor template) A vendor DPA template exists and is under counsel review before it is offered for signature.	In preparation	DateUnder counsel review, 2026-09	ObtainEmail support@aristai.io for the current draft; it is marked as a draft until counsel signs off.
FERPA posture statement Summarized on this page. The full statement cites the code paths behind each claim.	In preparation	DateDrafted 2026-07-31; under counsel review	ObtainEmail support@aristai.io.
Subprocessor and data-residency table Listed on this page.	Published	Date2026-09-17	ObtainRead it below; a dated copy is provided with the DPA.
AI governance summary Listed on this page, written from what the code does.	Published	Date2026-09-17	ObtainRead it below.
Pilot terms structure The structure is on this page; the priced proposal is prepared per institution.	Published	Date2026-09-17	ObtainRead it below; email support@aristai.io for the proposal.

FERPA and the DPA

A school-official posture, written from the code paths.

The posture statement was drafted 2026-07-31 and cites the repository behind each claim. It and the vendor DPA template are under counsel review; neither is offered as legal advice until that review closes.

Per-student records are never requested. Grade data enters only as small-cell-suppressed aggregates.

School-official model: For the scheduling platform, AristAI operates as a school official with a legitimate educational interest under 34 CFR 99.31(a)(1)(i)(B): the institution keeps direct control of the data and AristAI uses it only for the contracted service.
No per-student rows: The supported grades import accepts per-course, per-term aggregates only. Cells below a minimum enrollment are suppressed at import.
Calendar sync reads free/busy only: Faculty availability sync ingests free/busy blocks, not event contents or email. Instructor names and preferences are personnel data, covered by ordinary confidentiality terms.
Match demo stores nothing: The OptiMatch shadow endpoint rejects identifiers it can detect, runs in memory, writes nothing to the database, and never logs uploaded rows.
Named open items: The posture statement lists its own gaps: no DSA has been executed yet and a written retention and deletion schedule is still to be defined. Both are part of the counsel review.

Subprocessors and residency

Three subprocessors. Data stays in the United States.

Dated 2026-09-17. The exact hosting regions are confirmed in writing on request rather than asserted here. A dated copy of this table accompanies the DPA.

Subprocessors, their purpose, and data residency.
Subprocessor	Purpose	Residency
Vercel	Application hosting	United States; exact region confirmed on request
Supabase	Managed PostgreSQL and authentication (AWS-backed)	United States; exact region confirmed on request
Google	Gemini API for AI features	United States; exact region confirmed on request

AI governance

Drafted by a rule engine. Explained by AI. Decided by people.

This summary is written from what the code does, not from a policy document. Each feature lists the human control point that sits between the model and your schedule.

Schedule drafts: Produced by a deterministic, rule-based engine, not by a language model. The same inputs give the same draft.; Human controlReview-then-apply: nothing is written to the schedule until a signed-in person applies the draft.
Constraint interpretation: Turns a plain-language scheduling rule into a structured constraint.; Human controlThe structured result is shown back before it is used.
Conflict explanations: Explains a detected conflict and ranks possible fixes.; Human controlApplying a fix is an explicit action by the user.
Copilot commands: Interprets a typed request into a proposed action.; Human controlThe copilot returns a preview, including any conflicts the action would create; applying it is a separate action.
Import and intake analysis: Maps and checks incoming spreadsheet columns.; Human controlThe mapping is reviewed before rows are imported.
Syllabus drafts: Drafts curriculum text from an approved skill gap.; Human controlA code-level gate refuses to export a draft that has not been approved by a person.

Provider: AI features call Google's Gemini API through the official client. The model id is configured by environment and is not hard-coded to a single version.
No training on your data: No institution data is used to train models.
Model change notice: Thirty days' notice before the model behind a feature is changed.
What is drafted versus decided: AI drafts and explains. A named person applies, publishes, or exports.

Security practices

Six controls, each with the file that proves it.

The SOC 2 report covers the organization. These are the product controls a reviewer can read in the source.

Row-level security on every tenant table

Each institution's rows are isolated by database policy keyed to the signed-in user. There is no system-admin bypass in those policies; a platform administrator is scoped like any other member.

evidence migrations/2026-09-07-rls-admin-scoping.sql

Tenant isolation tests

A two-tenant live test proves one institution cannot read another's rows, and a static guard fails the build if any server-side read of a tenant table is missing its tenant filter.

evidence src/lib/tenancy/two-tenant.live.test.ts, read-guard.test.ts

Third-party credentials encrypted at rest

SIS and calendar credentials are encrypted before they are stored and versioned so keys can be rotated.

evidence src/lib/integrations/course-intake/ethos/secret.ts, src/lib/availability/crypto.ts

Audit log on admin and sharing actions

User-management changes and the issue or revocation of a public share link are written to an audit table that only the service role can read.

evidence src/lib/admin/audit.ts, migrations/2026-07-12-admin-user-management.sql

Per-endpoint rate limits on public surfaces

Public token pages and their data routes are limited together so neither can be used to enumerate tokens.

evidence src/lib/diagnostics/public.ts, src/app/api/diagnostic/[token]/route.ts, src/app/diagnostic/[token]/page.tsx

Expiring, revocable share links

Share links carry an expiry, can be revoked, and the public payload contains no internal identifiers.

evidence src/lib/diagnostics/public.ts, src/app/api/diagnostics/[id]/share/route.ts

Pilot terms

The structure every pilot shares.

The priced proposal is prepared per institution. The shape does not change.

01Fixed fee, agreed before the term starts.
02Term-scoped: one department or division, one academic term.
03Read-only toward your SIS. Nothing is written back.
0430-day exit at either party's notice.
05Your data is returned to you and then deleted on exit.

How to obtain

Ask, and the pack arrives with the proposal.

Email support@aristai.io with the artifact names you need. The SOC 2 report is exchanged under NDA. Start a schedule to open the pilot conversation, or explore the demo first.

Email support@aristai.io Start a schedule Explore the live demo

SOC 2 Type IIunder NDA
HECVAT 4 and insuranceon request
ACR, DPA, FERPA statementin preparation

Changelog

Last updated 2026-09-17

2026-09-17Page published: artifact register, FERPA posture summary, subprocessor table, AI governance summary, security practices, pilot terms structure.