Review draft · not an accepted contract
Legal, district and independent security review remain required. Publishing these pages does not establish compliance.
What we do now
V1 preserves session and role checks, school scope, restricted database operations, bounded requests and private-response cache controls. Administrators require a second factor; counselors have no additional mandatory Pavenyra factor.
What we do not collect or enable
No public signup, client-selected privileges, automatic bulk deletion, productivity surveillance or account credentials in public notices.
What changes in future versions
Institutional MFA remains applicable. New portals and real student workflows require separate authorization and tests.
Read the full draft
Recovery does not remove administrative MFA. New sessions, password changes and recovery links still require the applicable assurance checks. Existing factors must not be removed as a shortcut. Synthetic automated tests support implementation evidence; they do not prove a hosted configuration, independent penetration test or certification.
Security review remains open for deployed authentication, real Row Level Security, backup recovery and provider settings. No system is represented as 100% secure, FERPA certified, district approved or covered by a provider certification merely because that provider is used.
EN/ES editorial text; human legal and translation review pending.
Contact & requests
A monitored public channel is pending. Invited professionals: contact your invitation issuer without records or credentials.