Clear answers for
your review team.
This describes the local Accretive Thinking prototype. It is not a security certification or a promise about a future hosted service.
Download the school starter kit ↓At a glance
| Area | Current status |
|---|---|
| Hosting | Local files and an owner-run loopback server. No production school deployment. |
| SOC 2 | No Accretive Thinking SOC 2 report. Provider reports do not attest to Accretive Thinking. |
| School accounts / SSO | Not implemented. No school roles or tenant boundaries to assess yet. |
| Written practice data | In browser memory by default. Optional device saving for drafts, attempts, highlights and flashcard ratings. |
| Analytics | No analytics tracker or shared cohort dashboard installed. |
| Voice | Local preview using OpenAI. Audio is transmitted after consent and microphone permission. Live quality remains unverified. |
| Accessibility | Semantic controls, labels, visible focus, text alternatives and responsive layouts included. No WCAG conformance claim or ACR/VPAT. |
| Content | Original fictional scenarios. Arithmetic checks pass; qualified expert content review pending. No copied competitor question bank. |
Data flows
Written exercises and flashcards
Answers and notes are processed in the browser. The local numerical API, if used, receives supplied answer values and returns checks. The application does not add a database or send written answers automatically. Students choose whether to export work. Device saving is optional and is not encrypted application storage or cross-device sync; avoid it on shared computers.
Voice preview
The browser captures microphone audio after explicit consent and permission. A local server authenticates a WebRTC session with OpenAI; media is exchanged with the provider. The app displays a transcript and feedback in the browser. It does not store raw recordings or transcripts on the server. Provider processing, retention, region and contractual terms must be reviewed for the actual account before a school pilot. Do not assume no training or zero retention without verifying the applicable terms.
External links
Cal.com scheduling and other external services have their own policies. A future hosting provider may process request metadata; no production provider is selected.
Controls before a hosted school deployment
- Authentication, server authorization and tenant isolation for any shared school data.
- Admin MFA, least-privilege access, secrets management and dependency updates.
- Defined retention, deletion, export, backup and incident-response procedures.
- Provider agreements and institutional privacy review, including applicable student-record obligations.
- Server-enforced voice lifetime, abuse controls and spend limits.
- Accessibility testing with assistive technologies and documented remediation.
- Contracts and support expectations agreed with the institution.
These are outstanding requirements, not implemented controls. The current loopback host and Origin checks are for local testing, not a production security boundary.
Procurement materials
The starter kit contains a current-state security brief, a data-flow summary, an accessibility status note and a list of questions for the institution. It is not a completed HECVAT questionnaire, DPA, SLA, penetration test, SOC 2 report or independent accessibility assessment.
For a specific institutional review, use the current requirements supplied by that institution. Security, privacy and accessibility responses should be backed by evidence and reviewed by the responsible people.