HECVAT Lite Responses
Reference
Category
Question
Response
Additional Information / Notes
GEN-01
General Information
Vendor/company name and product name.
Dexter LLC
Legal entity: Dexter LLC. Product name: Dexter. In-app assistant is referred to as “Dexter”.
GEN-02
Provide a brief description of the product or service.
A mobile academic-coaching app for university/college students.
With the student’s permission it connects to their Canvas LMS account (read-only) to surface upcoming deadlines, flag possible submission problems, help the student prepare for assessments, and answer questions grounded in the student’s own course materials.
GEN-03
General Information
Is the solution hosted (SaaS/cloud), on-premise, or hybrid?
Cloud (SaaS)
Fully cloud-hosted; no on-premise component.
GEN-04
General Information
Where is the solution hosted?
Google Cloud Platform (United States)
Firebase / Google Cloud, region us-central1 (United States).
GEN-05
General Information
What categories of institutional/protected data are collected, stored, or processed?
Student education records
Student identity (name, Canvas user ID, institution ID, institutional email/login), course enrollments, assignments/quizzes/exams, grades and submission status, syllabi, course-material and announcement/message metadata, calendar events, and in-app content the student creates.
GEN-06
General Information
Estimated number of records/users.
Pilot deployment
Initial pilot. Approximate number of students is TBD.
GEN-07
General Information
Will the vendor access, store, or process data protected by FERPA?
Yes
Yes. Dexter processes student education records and operates as a “school official” with a legitimate educational interest under FERPA (34 CFR 99.31(a)(1)(i)(B)), subject to the institution’s direct control. See DPA + FERPA Addendum.
DOC-01
Documentation
Do you have a written information security policy?
In progress
Interim security practices are documented in the Dexter Security Overview.
DOC-02
Documentation
Do you have a published privacy policy?
Yes
See Dexter Privacy Policy (provided in this pack).
DOC-03
Documentation
Has your organization undergone an independent third-party security audit (e.g., SOC 2, ISO 27001)?
No (organization); Yes (infrastructure)
Dexter has not yet completed its own SOC 2 / ISO 27001 audit. The underlying infrastructure provider (Google Cloud) maintains SOC 1/2/3, ISO 27001, ISO 27017, and ISO 27018 certifications.
DOC-04
Documentation
Has a penetration test been performed in the last 12 months? Can a summary be shared?
No / Planned
No third-party penetration test has been performed to date.
DOC-05
Documentation
Do you maintain cyber liability / data breach insurance?
No / Planned
COMP-01
Third Parties
Do subcontractors or third parties store, process, or access institutional data?
Service providers only (no subcontractors)
Google Cloud / Firebase (infrastructure, database, storage, compute) and AI model provider(s) (Google Gemini and Anthropic Claude) used to generate coaching responses. A current subprocessor list is provided in the AI Data-Handling Statement and Security Overview.
COMP-02
Third Parties
Are third parties contractually bound to protect institutional data at a level consistent with your obligations?
Yes
Each subprocessor is engaged under its own data processing terms. Google Cloud operates under the Google Cloud Data Processing Addendum. AI provider(s) are engaged under enterprise/API terms.
APP-01
Application / Service Security
Is data encrypted in transit?
Yes
TLS 1.2+ for all connections; HTTPS enforced; HTTP Strict Transport Security (HSTS) enabled.
APP-02
Application / Service Security
Is data encrypted at rest?
Yes
AES-256 at rest via Google Cloud default encryption for Firestore and Cloud Storage.
APP-03
Application / Service Security
Do you store credentials for institutional systems (e.g., LMS passwords)?
No passwords
Dexter never receives or stores the student’s Canvas password. Access is via Canvas OAuth 2.0 with read-only scopes; OAuth access/refresh tokens are held in a server-side token vault and used only to read the student’s own data.
APP-04
Application / Service Security
Describe your secure software development practices.
Source control with reviewed changes, staged deployments, server-side input validation and identity checks, OAuth authentication via Canvas, user data encryption, and strong student data isolation practices.
Separate demo and production hosting are used.
APP-05
Application / Service Security
Do you perform vulnerability scanning and dependency management?
Partial
Runtime and OS patching are managed by Google Cloud managed services; application dependencies are updated on an ongoing basis. Formal scheduled scanning is planned.
IAM-01
Authentication / Authorization
How do end users authenticate?
Canvas OAuth 2.0
Students authenticate through their institution’s Canvas login (the institution’s identity provider). Dexter issues a signed, HTTP-only session cookie and uses CSRF protection for state-changing requests.
IAM-02
Authentication / Authorization
Is multi-factor authentication supported/required?
Inherited / Admin MFA
End-user MFA is not enforced by default unless the institution’s Canvas/IdP login enforces it. Administrative access to Dexter’s cloud infrastructure uses Google accounts with MFA.
IAM-03
Authentication / Authorization
Are least-privilege access controls applied to production data?
Yes
Production data access is limited to named administrators. Application-layer access is isolated per authenticated user with server-enforced identity matching.
IAM-04
Authentication / Authorization
Is access to systems and data logged?
Yes
Google Cloud audit logging is enabled; the application emits isolation/audit events (e.g., session creation, identity-mismatch rejections).
DATA-01
Data
Who owns the institutional data processed by the solution?
Institution / student
The institution and student retain ownership of all education records. Dexter acts only as a processor/service provider.
DATA-02
Data
In what country/region is data stored?
United States
Google Cloud region us-central1 (United States).
DATA-03
Data
Is institutional data logically or physically segregated from other customers’ data?
Logical isolation
Multi-tenant architecture with per-user record isolation keyed to the authenticated identity and enforced server-side.
DATA-04
Data
How is data returned and/or destroyed at the end of the relationship?
Deletion on request/termination
Student data is deleted within 14 days of account deletion, Canvas disconnection, or contract termination. Export can be provided on request.
DATA-05
Data
Are backups performed and encrypted?
Yes (managed)
Backups are managed by Google Cloud / Firestore and encrypted at rest.
DATA-06
Data
Is institutional data sold, shared for advertising, or used for any purpose other than providing the service?
No
Dexter does not sell student data, does not use it for advertising, and does not use it for any purpose other than providing and improving the service consistent with FERPA and the DPA.
DC-01
Datacenter / Cloud
Identify the hosting provider and its relevant certifications.
Google Cloud Platform
Google Cloud maintains SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, and publishes FERPA alignment. Certifications available at cloud.google.com/security/compliance.
DC-02
Datacenter / Cloud
Is physical security of the hosting environment addressed?
Yes (delegated)
Physical security is delegated to Google Cloud’s certified data centers (SOC 2 / ISO 27001).
PRIV-01
Privacy
Is a privacy policy published and available?
Yes
See Dexter Privacy Policy in this pack.
PRIV-02
Privacy
Does the solution comply with FERPA?
Yes
Dexter operates under the FERPA “school official” exception, uses education records only to provide the service, and does not re-disclose them except as directed by the institution or permitted by FERPA. See DPA + FERPA Addendum.
PRIV-03
Privacy
Is the solution subject to GDPR or other regional privacy laws?
No
Dexter is not available outside the US and Canada.
PRIV-04
Privacy
Do you use institutional/student data to train artificial intelligence or machine learning models?
No
Student data is processed by AI model providers (Google and Anthropic) only to generate the student’s own coaching responses, under terms that do not permit training on inputs and apply zero or limited retention. See AI Data-Handling Statement.
PRIV-05
Privacy
Describe your data breach notification process and timeline.
Within 72 hours
Upon confirming a breach affecting institutional data, Dexter notifies the institution without undue delay and within 72 hours, including the nature of the incident, data affected, and remediation steps.
POL-01
Policies / Procedures
Do you have a documented incident response plan?
In progress
A documented incident response process is in progress; institution notification commitment as in PRIV-05. Formal plan targeted for 12/1/2026.
POL-02
Policies / Procedures
Do employees receive security and privacy awareness training?
N/A — no hiring yet
This will be applied once hiring begins.
POL-03
Policies / Procedures
Are background checks performed on personnel with access to data?
N/A — no hiring yet
This will be applied once hiring begins.
BCDR-01
Business Continuity / DR
Do you have business continuity and disaster recovery capabilities?
Yes (managed)
Dexter relies on Google Cloud’s multi-zone managed services (Firestore, Cloud Functions, Hosting) for availability and recovery.
VULN-01
Vulnerability Management
How are systems patched and kept current?
Managed + ongoing
Infrastructure and runtime patching is handled by Google Cloud managed services; application dependencies are updated on an ongoing basis.
ACC-01
Accessibility
Is a VPAT / WCAG conformance statement available?
No — Planned
Will be available on 12/1/2026.