Trust Center
Reviewed
Standards
9 frameworksFERPACompliantProtects student records under U.S. privacy law.
FERPA is a U.S. law that limits who can access or share student education records. Mesura follows these rules for the student records in our university partnership.
About FERPAGDPRIn ProgressProtects personal information in the European Union (EU).
GDPR is the European Union's privacy law and can also apply to companies outside the EU. Some data protections are built into our software. We still need to confirm which rules apply and finish our privacy policies, data handling agreements and procedures for requests to view, correct or delete information.
About GDPRCCPA / CPRAIn ProgressGives California residents rights over their personal information.
CCPA is California's privacy law, expanded by the CPRA. People can ask to see, correct or delete their information and limit certain sales or sharing. Our software includes some access protections, but we still need to confirm which rules apply and finish our privacy notices, agreements and request procedures.
About CCPA / CPRASOC 2In ProgressChecks how a company protects customer data through an audit.
An independent accounting firm reviews how a company protects customer data and issues a SOC 2 report. Our software includes some security protections. We still need to collect the records an auditor needs and complete the independent audit. We do not have a SOC 2 report.
About SOC 2ISO/IEC 27001In ProgressAn international standard for keeping information secure.
We use this international standard to guide how we protect information. We still need to check that our safeguards work in practice and finish our internal and leadership reviews. We are not certified.
About ISO/IEC 27001ISO/IEC 27701In ProgressAn international standard for protecting personal information.
We use this international standard to guide how we handle personal information. We still need to document how data is used, check our privacy procedures and complete internal and leadership reviews. We are not certified.
About ISO/IEC 27701ISO/IEC 27017In ProgressInternational guidance for keeping cloud services secure.
These international guidelines cover security for cloud services. We still need to confirm which safeguards Seyir and its providers are responsible for. We also need to finish checks on keeping university data separate, protecting stored information and recovering from outages.
About ISO/IEC 27017ISO/IEC 27018In ProgressInternational guidance for personal information in public clouds.
These international guidelines cover personal information held by public cloud providers: companies that offer online computing services to many customers. We still need to finish our data handling agreements and review other companies involved. We also need to check how long information is kept and how it is deleted.
About ISO/IEC 27018CSA STARIn ProgressA global program for checking cloud service security.
We use the Cloud Security Alliance's checklist to review our cloud security. We still need to finish that review and publish the results. We do not have a STAR Registry listing, certification or independent audit report.
About CSA STARControls
Current implementation and the work still open.
16 control areas
Access & identityAuthentication & sessionsIn ProgressInstitution-scoped sign-in and session management.
Institutional identity configuration, credential lifecycle, and operating verification remain in progress.
Access & identityRecord authorizationCode implementedAccess follows the authenticated record owner.
The code enforces record ownership, row-level authorization, and narrowly granted database routines. Deployed access reviews and institutional operating evidence remain open.
Access & identityUniversity data boundariesIn ProgressSeparate access boundaries for each institution.
Tenant isolation and cross-institution access prevention are part of the control program. Full boundary verification and operating assessment remain in progress.
Data protectionSecure transportCode implementedPublic application endpoints require HTTPS.
The code rejects unsafe public plaintext endpoints and redirects, and includes transport-header checks. Full deployment and internal-service transport verification remain in progress.
Data protectionStorage encryption & keysIn ProgressEncryption settings and key-management responsibilities.
The assessment covers encryption at rest, key access, rotation, recovery, and the responsibilities of cloud providers and Seyir. Complete operating evidence remains open.
Data protectionRetention & deletionIn ProgressData lifecycles, deletion holds, and return of records.
Retention rules, authorized data return, verified deletion, and backup aging are being developed and assessed. Institutional instructions and end-to-end operating evidence remain open.
Product securityRequest & input safeguardsCode implementedBounded requests and fail-closed public errors.
Repository controls validate origins and payloads, verify authentication, bound requests, and reject unsafe input. Production configuration and operating verification remain separate work.
Product securityAcademic plan validationCode implementedDeterministic checks before a proposed plan is shown.
The planning code withholds output when deterministic academic validation cannot prove the proposed path. This describes product validation within the modeled academic rules, with institutional review and operating evidence still required.
Product securityDevelopment & change reviewIn ProgressSecurity requirements, review, testing, and rollback.
The program includes secure development, dependency review, patching, release approval, and rollback procedures. Complete approval and operating records remain in progress.
AI & suppliersModel-provider data useIn ProgressPurpose, recipient, and payload boundaries for AI requests.
Provider egress, data minimization, retention and secondary-use terms, and customer approvals are part of the assessment. Live institutional data use requires the remaining agreements and approvals.
AI & suppliersSupplier reviewIn ProgressProvider due diligence and shared responsibilities.
Supplier inventories, contractual terms, cloud responsibilities, and customer approvals are being assessed. A provider’s own assurance does not establish Seyir’s compliance.
OperationsLogging & monitoringIn ProgressSecurity events, review, and alert delivery.
The program covers log access, data minimization, retention, monitoring, and alerts. Complete delivery tests, review records, and operating evidence remain in progress.
OperationsIncident responseIn ProgressResponse ownership, escalation, and notification readiness.
Incident procedures and notification arrangements are being developed. Exercises, institutional contacts, and complete operating evidence remain open.
OperationsBackups & recoveryIn ProgressRestoration safeguards and continuity testing.
The program includes backup protection, restoration, continuity planning, and recovery testing. Complete scoped exercises and institutional operating evidence remain in progress.
Governance & privacyPrivacy & student rightsIn ProgressPurpose limitation, consent, access, and correction.
Privacy notices, authorization, education-record rights, and applicable processing roles remain under development and assessment. Legal and institutional review remain open.
Governance & privacyRisk & assurance reviewIn ProgressControl mapping, internal review, and corrective action.
The program maps controls to the listed standards. Complete internal assessment, management review, corrective actions, and any external assurance result remain outstanding.
No controls match these filters.