Technical Information

 

System Administration FAQ

How often do you schedule maintenance operations?
A: Regular updates are published every two weeks. Emergency patches can be released anytime. These changes don’t incur downtime; users may need to log in again. Scheduled downtime is rare (about once or twice a year).

How long is a typical maintenance window where the system is unavailable?
A: Application updates do not involve downtime. Maintenance windows vary by operation and can range from about 15 minutes to an hour.

How is the data backed up?
A: Six copies of the database are continuously maintained across three AWS availability zones. database logging is kept for 30 days; snapshots are available for up to one year.

 

Security FAQ

Is the data encrypted?
A: Yes — all data is encrypted both at rest and in transit.

Do you use SSL/HTTPS?
A: Yes. All web servers use SSL over HTTPS. HTTPS is enforced by load balancers and additional security headers are applied to force HTTPS connections.

Do you support TLS v1.1 or higher?
A: Yes.

Are you PCI compliant?
A: Our credit card processor is PCI compliant. We do not store credit card data.

Do you conduct regular penetration testing?
A: Yes.

How do you monitor for security vulnerabilities?
A: We use dynamic, automatic monitoring for network threats and regular static code analysis to identify issues (including OWASP Top 10 and dependency vulnerabilities).

Do you require the use of Flash or any other plugin?
A: No. The application does not use Flash or Java plugins. Adobe Acrobat is required to view certain reports but does not need to be configured as a plugin.

Do you require the use of cookies?
A: No.

Do you use browser popups?
A: Only for certain reports.

How are users’ capabilities restricted?
A: The system uses an extensive role-based model controlling access down to record and field level, and which service endpoints are accessible. Permissions are evaluated on the server.

 

Integrations FAQ

Do you support LTI?
A: Yes — for auto-provisioning users and courses.

Which SSO technologies do you support?
A: SAML.

How do you expose data for reporting purposes?
A: Integrated reports, CSV export, SFTP downloads (custom integration), and access to a read-only replica of the Aurora (MySQL) database.

What analytics engines are supported?
A: Any analytics engine that can work with MySQL data.

How can data be imported into the system?
A: Web upload and automated uploads via SFTP using formatted data.