Skip to main content

For IT reviewers

This page helps security, privacy, and procurement reviewers evaluate SpeechGradebook before or during adoption. All linked articles are available without signing in.

  1. Trust overview
  2. Security plan
  3. Security overview
  4. HECVAT 4 response guide
  5. Completed HECVAT 4.1.6 workbook
  6. Institutional addendum (U.S. residency / LTI 1.3 / MFA)
  7. VPAT / Accessibility Conformance Report
  8. Privacy and legal policies
  9. Subprocessors and data locations
  10. FERPA and student records
  11. Data handling and retention
  12. Student consent model
  13. Role permissions
  14. Incident response and contact

Architecture summary​

ComponentPurpose
SpeechGradebook web appUser interface and API (FastAPI on Render)
SupabaseAuthentication, database, and media storage (AES-256 at rest; U.S. residency for U.S. institutions)
SpeechGradebook Model (Qwen)AI evaluation service (proxied via /qwen-api/*)
LTI 1.3Canvas/LMS launch SSO (OIDC)

Row-level security (RLS) in Supabase restricts data access by role and institution. Audit logs record access to student evaluation data. MFA (TOTP) is available for portal logins; LMS users authenticate via Canvas/LTI (and any campus MFA required there). Instructional media uploads are authenticated; objects are currently served via public object URLs under user/institution path prefixes (private bucket + signed URLs planned).