Higher-education readiness
Institutional Readiness
RSearch is preparing the evidence universities commonly request for privacy, security, accessibility, and third-party risk review. The current preparation baseline uses HECVAT 4.1.6.
Status: preparation in progress. RSearch does not represent this page as a completed institutional security assessment.
HECVAT preparation areas
Data flow and classificationDocument browser-local research execution, online services, telemetry, Collaboration, support, optional AI, and the boundaries between them.Evidence available, formal questionnaire mapping in progress.Identity and accessDocument guest research use, Google identity for Collaboration, permissions, invitations, session handling, and planned institutional identity support.Partially ready.Privacy and retentionDocument raw-row handling, browser storage, server-held account/support data, retention, deletion requests, and subprocessor responsibilities.Policy baseline available, retention matrix to formalize.Security operationsFormalize vulnerability management, dependency controls, incident response, security contacts, logging, change control, and release evidence.Engineering controls exist, institutional packet still being assembled.AI governanceDocument optional AI consent, approved-context boundaries, raw-row exclusion, provider use, model configuration, and researcher responsibility.Product boundaries available, procurement wording to formalize.AccessibilityTarget WCAG 2.2 Level AA, document testing evidence, exceptions, remediation, and an eventual Accessibility Conformance Report.Structured review in progress.Business continuityDocument hosting architecture, recovery expectations, service dependencies, backups for server-held services, and the distinction between service recovery and local research data.Formal institutional document required.Vendor and subprocessor inventoryMaintain a current list of hosting, identity, analytics, email/support, and optional AI providers with the data each service can receive.Formal inventory required. Institutional packet being prepared
- HECVAT 4.1.6 response workbook and evidence cross-reference.
- System and research-data flow diagram.
- Security overview and vulnerability-management summary.
- Incident-response and security-contact document.
- Data-retention and deletion matrix.
- Subprocessor inventory.
- AI use and data-boundary statement.
- Accessibility testing record and future ACR/VPAT response.
- Business continuity and recovery statement.
- Privacy, terms, and institutional agreement materials where required.
Research-data architecture matters
The qualified statistical workflow is designed so raw research rows remain in the browser during local execution. Online account, Collaboration, support, analytics, and optional AI services are separate boundaries and must be described separately in institutional review. This distinction should be preserved in every HECVAT answer rather than making the broader claim that the entire website is offline.
