CASEWORK · CURRENT-STATE PROCUREMENT BRIEF · 19 OCTOBER 2026
Scope: local files and owner-run loopback server, not a hosted school deployment.
SOC 2: no Accretive Thinking report. No security certification or completed HECVAT claimed.
Accounts / SSO / roles / tenancy: not implemented.
Written exercises: browser memory by default; optional localStorage persistence.
Data saved if opted in: drafts, explanations, attempts, highlights, flashcard self-ratings.
Clear control removes the app's saved copy; browser exports are controlled by students.
No automatic written-answer upload, shared database or analytics tracker installed.
A local grading API can receive provided numerical answers; app adds no logging.
Voice: OpenAI processes consented audio via WebRTC. API secret stays on local server.
App does not save raw recordings or transcripts on server. Provider retention,
region, training use and contractual terms need account-specific review.
Cal.com: external scheduling service. No production host selected.
Security controls needed before hosting: authentication/authorization, tenant
isolation, admin MFA, secrets management, audit events, incident response, tested
backup/recovery where applicable, retention/deletion and server-side voice limits.
Accessibility: labels, keyboard-operable native controls, focus styles, text
alternatives and responsive layouts included. Some flows reviewed at 390px.
No comprehensive assistive-technology audit, WCAG conformance claim or ACR/VPAT.
Highlight selection may be less accessible than core written practice; test with
institutional accessibility reviewers. Offline text handouts are an alternative.
Content: original fictional scenarios. Calculation tests passed; expert review pending.
Legal: no claim of FERPA compliance, institutional approval, DPA or SLA in this pack.
Ask the institution for its current HECVAT / vendor questionnaire and accessibility
requirements; have responsible reviewers verify responses with evidence.
Contact / pilot conversation: https://cal.com/sean-b/intro
