Trust & Security
Evidence requires trust.
Reasonline handles academic work, student responses, learning interactions, assessment evidence, and institutional data. That makes precision important.
Say what is implemented. Say what is still being validated. Keep consequential academic decisions human.
Academic judgment remains human.
Reasonline may generate learning interactions, ask assessment questions, organize evidence, suggest rubric connections, surface patterns, or recommend a possible next action. Those functions are designed to support human academic judgment. Reasonline is not designed to autonomously assign final grades, determine misconduct, rank students by hidden risk, or impose academic penalties.
The evidence can inform the decision. The consequential academic decision remains with a person.
Know where the data goes
A submission moves through Reasonline’s application services (hosted on Supabase, with row-level security enforced by the database), out to specific vendors for narrow, specific jobs, and back to the instructor — who is the only step that decides a grade. Payment is a separate path entirely.
Student / Instructor
Payment
Stripe-hosted — isolated
Reasonline application
Supabase + row-level security
Anthropic Claude
Dialogue, course authoring & evidence review
Deepgram
Transcription — audio/video only
Resend
Transactional email, where configured
Cloudflare Turnstile
Bot protection on sign-in, where enabled
Instructor review — the only step that decides a grade
Payment has no line to the rest of the diagram on purpose — card details are handled entirely by Stripe and never reach Reasonline’s own servers.
Process evidence in Reasonline AgencyThread
AgencyThread (Early Access; pilots begin January 2027) adds a new kind of student data: AI conversations, drafts, version history, and sources. The evidence packet is stored in Reasonline’s private storage on Supabase. To write a report, Reasonline sends the packet for one assignment to a third-party AI model provider’s API with response storage turned off; PDFs go to the provider’s file service, set to expire within an hour, and are deleted when the evaluation finishes. The report returns to the instructor, who decides whether the student sees it. Reports never change a grade and are never sent to an LMS as a grade.
No student submits AgencyThread evidence until every control below is in place and the student’s institution has approved the use of student records through its own route.
| AgencyThread control | Status |
|---|---|
| Row-level security on every AgencyThread table and storage bucket, with role tests for students, TAs, and other instructors | IN DEVELOPMENT |
| File type checks, size and count limits, and content safety checks on every upload | IN DEVELOPMENT |
| Highest-trust evidence only from records Reasonline captured itself, never from a student's own label | IN DEVELOPMENT |
| The AI model provider named in our privacy policy, with response storage off and uploaded files deleted after each evaluation | IN DEVELOPMENT |
| Reports private to the instructor by default, with a student correction route | IN DEVELOPMENT |
| Retention schedule, plus student data export and erase covering AgencyThread records and files | IN DEVELOPMENT |
| Research data kept apart from product data, with its own consent process | IN DEVELOPMENT |
| Automated accessibility scan and a manual keyboard and screen-reader pass on the new screens | IN DEVELOPMENT |
George assists the interaction. George does not own the decision.
No autonomous grade
George's suggestions remain visibly separate from the instructor's decision — every suggestion can be accepted, revised, or ignored. Grades stay private until an instructor releases them.
No silent changes to your course
When Reasonline suggests an intervention and you accept it, it creates a draft for you to review — nothing is published to students automatically. Patterns seen in too few students are watched, not acted on.
No authorship claim
The system doesn't label student work as AI-generated or human-generated.
Bounded context
George receives only the materials required for the configured interaction — the task, the student's work where applicable, and the dialogue so far.
Instructor controls
Rounds, timing, response modes, and stopping rules are set by the instructor, not George.
Evidence Context starts with what Reasonline set up.
Reasonline can preserve important information about the conditions surrounding a learning or assessment experience without secretly inferring what a student did elsewhere. Evidence Context begins with explicit information about the experience itself: what support was available, how George was configured to help, what students had to do themselves, whether the work was individual or part of a team, and what assessment condition was configured.
If Reasonline later works alongside an institution’s own exam-security or lockdown tools, those capabilities will be represented separately and only at their verified status.
Implemented today
Role-based access control
Site admin, school admin, instructor, co-instructor, teaching assistant, and student roles are enforced server-side on every request — not just hidden in the UI. Teaching assistants can grade and review evidence but cannot release grades or act on recommendations.
Per-school data isolation
Database-level row security scopes every query to the caller's own school — one school's admin cannot read another school's rosters or activity, enforced by the database itself, not application logic alone.
Audit logging
Every sensitive admin action — roster changes, role grants, billing overrides — is written to an audit log with who did it and when.
Standards-based LMS integration
LTI 1.3 launches are verified signed JWTs checked against your LMS's own published keys, with nonce-based replay protection — see Integrations for detail.
Instructor-approved grade release
Saving a grade keeps it private. Students — and the LMS gradebook — see a grade only after an instructor releases it, and a later edit stays private until it is released again.
Student data requests
Reasonline can export everything it holds for a student, or erase it, on request. Each request is logged without recording the student's email address.
Grade export
Instructors can export course and assignment grades — including overrides and what each student currently sees — as CSV.
Payments handled by Stripe
Checkout and billing management run on Stripe-hosted pages — card details never touch Reasonline's own servers.
In progress
Formal procurement and compliance documentation — a Data Processing Agreement, a HECVAT response, and a documented FERPA posture — is currently being prepared for institutional pilots. We do not hold a SOC 2 report or other third-party certification today, and won’t claim one until it’s real. Where a control is planned but not yet complete, we say so — a visible roadmap is better than a false assurance.
Accessibility
Alternative paths are part of assessment and learning-experience design, not a future add-on to a video-first product. These are design requirements Reasonline builds to; they are not the same thing as formally verified conformance, and we won’t claim a WCAG conformance level until it has actually been tested and documented.
- →Written response is always available as a fair alternative to audio or video.
- →Audio and video responses are transcribed, so a text transcript is available for review.
- →Per-student accommodations — extra preparation time, response time, or an alternate response mode — are configurable by the instructor.
- →Keyboard navigation and focus handling are part of ordinary QA, not a separate accessibility pass.
- →Core student and instructor pages pass an automated WCAG 2 A/AA scan. A manual audit and a formal conformance report have not been completed yet.
Product status is part of trust.
Access status and claim maturity are separate. A badge says whether you can use a capability. Where an output makes a measurement claim, such as the composite Human Agency Index, a separate note says how mature that claim is (for example, “Validation in progress”), so a working Early Access feature never implies validated measurement.