Trust & Security
Evidence requires trust.
Reasonline handles academic work, student responses, learning interactions, assessment evidence, and institutional data. That makes precision important.
Say what is implemented. Say what is still being validated. Keep consequential academic decisions human.
Academic judgment remains human.
Reasonline may generate learning interactions, ask assessment questions, organize evidence, suggest rubric connections, surface patterns, or recommend a possible next action. Those functions are designed to support human academic judgment. Reasonline is not designed to autonomously assign final grades, determine misconduct, rank students by hidden risk, or impose academic penalties.
The evidence can inform the decision. The consequential academic decision remains with a person.
Know where the data goes
A submission moves through Reasonline’s application services (hosted on Supabase, with row-level security enforced by the database), out to specific vendors for narrow, specific jobs, and back to the instructor — who is the only step that decides a grade. Payment is a separate path entirely.
Student / Instructor
Payment
Stripe-hosted — isolated
Reasonline application
Supabase + row-level security
Anthropic Claude
Dialogue, course authoring & evidence review
Deepgram
Transcription — audio/video only
Resend
Transactional email, where configured
Cloudflare Turnstile
Bot protection on sign-in, where enabled
Instructor review — the only step that decides a grade
Payment has no line to the rest of the diagram on purpose — card details are handled entirely by Stripe and never reach Reasonline’s own servers.
George assists the interaction. George does not own the decision.
No autonomous grade
George's suggestions remain visibly separate from the instructor's decision — every suggestion can be accepted, revised, or ignored.
No authorship claim
The system doesn't label student work as AI-generated or human-generated.
Bounded context
George receives only the materials required for the configured interaction — the task, the student's work where applicable, and the dialogue so far.
Instructor controls
Rounds, timing, response modes, and stopping rules are set by the instructor, not George.
Evidence Context does not require hidden surveillance.
Reasonline can preserve important information about the conditions surrounding a learning or assessment experience without secretly inferring what a student did elsewhere. Evidence Context begins with explicit information about the experience itself: what support was available, how the interaction was designed, what feedback occurred, and what assessment condition was configured.
If Reasonline later offers or integrates institution-approved integrity, proctoring, lockdown, or related controls, those capabilities will be represented separately and only at their verified status.
Implemented today
Role-based access control
Site admin, school admin, instructor, and student roles are enforced server-side on every request — not just hidden in the UI.
Per-school data isolation
Database-level row security scopes every query to the caller's own school — one school's admin cannot read another school's rosters or activity, enforced by the database itself, not application logic alone.
Audit logging
Every sensitive admin action — roster changes, role grants, billing overrides — is written to an audit log with who did it and when.
Standards-based LMS integration
LTI 1.3 launches are verified signed JWTs checked against your LMS's own published keys, with nonce-based replay protection — see Integrations for detail.
Payments handled by Stripe
Checkout and billing management run on Stripe-hosted pages — card details never touch Reasonline's own servers.
In progress
Formal procurement and compliance documentation — a Data Processing Agreement, a HECVAT response, and a documented FERPA posture — is currently being prepared for institutional pilots. We do not hold a SOC 2 report or other third-party certification today, and won’t claim one until it’s real. Where a control is planned but not yet complete, we say so — a visible roadmap is better than a false assurance.
Accessibility
Alternative paths are part of assessment and learning-experience design, not a future add-on to a video-first product. These are design requirements Reasonline builds to; they are not the same thing as formally verified conformance, and we won’t claim a WCAG conformance level until it has actually been tested and documented.
- →Written response is always available as a fair alternative to audio or video.
- →Audio and video responses are transcribed, so a synced text transcript is always reviewable.
- →Per-student accommodations — extra preparation time, response time, or an alternate response mode — are configurable by the instructor.
- →Keyboard navigation and focus handling are part of ordinary QA, not a separate accessibility pass.