Trust & Security
What we hold, what we build, and what is roadmap
Procurement reviewers ask direct questions; this page gives direct answers. We hold no certifications yet and we say so. What exists instead is architecture: controls enforced by the software, an audit trail that proves them, and a written roadmap for every attestation a university review will ask about.
Measured availability, not an SLA
We do not offer an uptime-percentage SLA today, and we will not quote one we cannot attest. Instead, a synthetic check exercises the real production write path every 15 minutes and we publish exactly what it measures. The number below is a measurement shared for transparency, not a contractual guarantee. During pilots, support commitments are staffed commitments written into the agreement: critical issues acknowledged within four business hours.
Certifications: the honest table
| If you ask for | Straight answer | What exists instead, today |
|---|---|---|
| SOC 2 | Not held yet; on the roadmap, engagement planned at pilot conversion. | The control substance without the attestation: database-level tenant isolation, a tamper-evident audit trail, encrypted secret storage, and a written security response pack available on request. |
| HIPAA / BAA | No HIPAA program; we do not sign BAAs. | Cavi for Disability Services handles education records under FERPA framing, not covered-entity clinical workflows. Your counsel confirms categorization; our architecture facts are documented for that review. |
| VPAT / accessibility conformance | No third-party certification yet; a vendor VPAT 2.5 draft self-assessment is available on request. | Accessibility is an enforced engineering practice: a WCAG-oriented review checklist gates UI changes and automated accessibility checks run in our CI pipeline. A third-party conformance report is a pilot-conversion roadmap item. |
| Penetration test | None on file yet; planned at pilot conversion. | We disclose our remediation history rather than hiding it: previously found-and-fixed issues are documented as evidence the controls are audited, not assumed. |
| FedRAMP / StateRAMP | Not held and not planned. | We say so plainly rather than implying otherwise. |
A questionnaire-grade security and governance response pack, a compliance roadmap one-pager, the VPAT draft, and our incident response playbook are available to reviewers on request via hello@graymarstrategies.com.
The architecture that stands in for the logos
- Tenant isolation at the database layer. Every tenant-scoped table enforces row-level security, and privileged access paths append to a tenant-visible access ledger.
- Tamper-evident audit. Disability services case events are hash-chained and append-only for every role; a verification routine re-walks the chain to detect tampering, and any case history reconstructs on demand.
- FERPA-safe by construction. Outbound payloads pass a deny-by-default allow-list per recipient; the faculty letter schema has no diagnostic fields, so a letter cannot carry a diagnosis.
- Humans decide. AI drafts and routes; client-facing sends wait for human approval, and a closed prohibited-automation register bars the system from eligibility scoring, credibility judgments, or deciding a case.
- Data lifecycle you can verify. Deletion produces hashed receipts; retention classes are applied and pruned automatically; subprocessors are inventoried in writing.
- A certificate you can hand to your own stakeholders. Each approved deliverable carries a verification code. Anyone with the code opens a public certificate showing that a person approved the asset and how the governed quality review scored it, compliance, craft, brand, and visual, without exposing the asset, its recipient, or its subject.
Enterprise identity for institutions
Disability Services staff sign in through their institution's own identity provider: per-institution SAML or OIDC with SCIM de-provisioning, so removing someone in the campus IdP removes their Cavi access. Each campus's SSO configuration is validated with its IdP during onboarding before live sign-in is enabled. Institutional SSO can never grant GrayMar operator privileges, and every sign-in and provisioning change writes an audit event.