Skip to content
AnglinAI Docs

HECVAT — Draft Answer Set

Working answers for the Higher Education Community Vendor Assessment Toolkit, organized by HECVAT section. Transpose into the official spreadsheet when a campus sends one; keep this file as the source of truth so every institution gets consistent answers. Answers marked [GAP] are honest current-state — decide remediation or disclosure before submitting.

Companion doc: data-flow-subprocessors.md (attach it to every submission).

Company Overview

  • Product: Gevell platform — document accessibility conversion and auditing (PDF, web, slides, forms) for WCAG 2.1 AA / PDF/UA-1 compliance.
  • Company: AnglinAI (sole proprietorship of Larry Anglin). Small-vendor posture: answers below reflect a small team with heavy automation, not a large security office. Say so plainly — reviewers score honesty well.
  • Hosting model: SaaS. Cloud-hosted (AWS, Cloudflare, Supabase) with one vendor-managed processing node (see Datacenter).

Documentation & Assessment

  • Information security practices are documented in-repo (docs/admin/security/, docs/admin/disaster-recovery.md, global standards in engineering guidelines). [GAP] No standalone formal InfoSec policy document yet — generate from the standards before first submission.
  • Third-party audit: No SOC 2 / ISO 27001. Compensating evidence: automated nightly security audits, dependency scanning (Dependabot + npm audit in CI), WCAG/accessibility CI gates, and this documented control set. SOC 2 roadmap letter available.
  • TX-RAMP (Texas institutions): not yet certified; we request institution sponsorship for provisional certification at contract time.

Application Security

  • Authentication: Supabase Auth — email magic link and 6-digit email OTP. No passwords stored by us. SSO (SAML/institutional IdP) not yet offered [GAP — commonly requested; note as roadmap].
  • Authorization: Role-gated admin surfaces; row-level security (RLS) on customer tables in PostgreSQL; API routes enforce user scoping at the boundary.
  • Session management: Supabase JWT sessions; tokens expire and refresh per Supabase defaults.
  • Input validation: All user input validated at system boundaries; parameterized queries only; no string-concatenated SQL.
  • Secure SDLC: All changes via GitHub pull request with CI (tests, accessibility audit, dependency audit) gating merge; production deploys only from the main branch.

Data

  • Classification: Customer documents treated as confidential; may contain FERPA-covered records. No PHI accepted (contractually excluded).
  • Encryption in transit: TLS 1.2+ on every hop (browser↔Cloudflare, Cloudflare↔AWS, service↔Supabase, service↔Bedrock).
  • Encryption at rest: Cloudflare R2, AWS S3, and Supabase all encrypt at rest (AES-256, provider-managed keys).
  • Retention: Documents retained until the customer deletes them or deletes their account; operational logs 30 days; backups 30 days (ops data) / provider-managed (database).
  • Disposal: Account deletion cascades to database rows and R2 objects (docs/admin/access/account-deletion.md).
  • AI/ML disclosure (increasingly a HECVAT section): document inference runs on AWS Bedrock (Anthropic Claude) under zero-data-retention — inputs are not retained by the model provider and are never used for training. Legacy Google Gemini paths are being retired from document processing (#2242). Mathpix receives page images for math OCR only.

Database

  • Managed PostgreSQL (Supabase, AWS us-east-2). RLS enforced; service-role access restricted to backend services. Daily automated backups by provider. Schema changes only via versioned migrations.

Datacenter / Infrastructure

  • AWS us-east-1 (Lambda, SQS, S3, Bedrock), Cloudflare (global edge, US R2), Supabase us-east-2. Physical security inherited from providers (AWS/Cloudflare SOC 2 / ISO 27001 attestations available from them).
  • Processing node: one vendor-managed Docker host handles large chunked conversions. It is on a private network, reachable only via outbound Cloudflare Tunnel (no inbound ports), disk-encrypted, and holds documents only transiently during processing. [GAP] This is the answer reviewers will probe; migration of this workload to cloud compute is on the roadmap — represent it accurately, never as “all cloud.”

Change Management

  • Git-based; every production change is a reviewed PR with passing CI. Migrations are versioned and applied deliberately. Rollback = redeploy prior commit; database migrations are applied additively ahead of code.

Business Continuity / Disaster Recovery

  • docs/admin/disaster-recovery.md. Database: provider daily backups. Object storage: R2 durability + S3 copies for processing. Ops host: nightly encrypted backups to Backblaze B2, 30-day retention, restore tested quarterly. [GAP] Document RTO/RPO numbers per system before submission (HECVAT asks for figures).

Incident Response

  • Monitoring: Grafana alert rules (error rate, fatal errors, heartbeat), Uptime Kuma on production endpoints, email + Telegram alerting with 5-minute cooldown; spend anomaly alerts.
  • [GAP] Formalize the IR runbook (roles, severity levels, customer notification timelines — 72-hour breach notification is the standard ask) before first submission.

Vulnerability Management

  • Dependabot weekly across repos; npm audit in CI and nightly cron with emailed reports; critical/high findings fixed or documented, never ignored. [GAP] No third-party penetration test yet — if UTH requires one, a scoped external test of the two customer-facing apps is the cheapest satisfying evidence.

Physical Security

  • Cloud providers: inherited (cite AWS/Cloudflare attestations). Processing node: locked facility, disk encryption, no inbound network exposure.

Policies & Personnel

  • Single-operator company: access to production is limited to the owner, MFA on GitHub/AWS/Cloudflare/Supabase/Stripe accounts. No offshore staff, no contractors with production access.
  • [GAP] Written acceptable-use/security policy and (if headcount grows) background-check statement.

HIPAA

  • Out of scope: the service is not offered for PHI, no BAA is executed, and contracts exclude PHI uploads. State this plainly in the HIPAA tab.

FERPA

  • We act as a school official / service provider under the institution’s direction for documents containing student records: data used only to provide the service, no advertising use, no sale, deletion on request, subprocessors bound as above. FERPA rider language acceptable.

Pre-submission checklist (do these before the first campus sends the sheet)

  1. Convert the engineering standards into a short formal InfoSec Policy PDF.
  2. Write RTO/RPO figures into disaster-recovery.md.
  3. Formal IR runbook with notification timelines.
  4. Close or credibly schedule #2242 (Gemini) and #2243 (secrets).
  5. Get the cyber-liability insurance certificate ready to attach.
  6. Confirm MFA is actually enabled on every provider account listed above.