SOC 2 Controls Overview
Audience: Security reviewers, procurement, and district IT leadership
Status: SOC 2 Type II readiness — formal audit scheduled per customer contract
Overview
Ember LMS is designed around the AICPA Trust Services Criteria (TSC) that underpin SOC 2 Type II reports. This overview describes what we control and how districts can verify it — without exposing internal implementation details.
For auditor-ready evidence packages (policies, screenshots, sample exports), contact security@ember.edu.
Trust Services Criteria mapping
| TSC | Control area | How Ember addresses it |
|---|---|---|
| CC6.1 | Logical access | Organization-scoped roles, course enrollments, and quarterly access review exports for admins |
| CC6.2 | Credential management | Strong password policy, account lockout, and optional SSO for district identity providers |
| CC6.3 | Role-based access | Teachers, students, parents, and admins see only data their role permits (FERPA-aligned) |
| CC6.6 | System boundaries | Authenticated API access, TLS in transit, and tenant isolation between districts |
| CC6.7 | Data access logging | Audit trail when student education records are viewed, exported, or changed |
| CC7.2 | Security monitoring | Compliance dashboard for org admins with activity summaries |
| CC8.1 | Change management | Peer-reviewed releases, automated test gates, and documented deployment process |
| CC9.2 | Vendor risk | Third-party AI, email, and storage providers are contractually bounded; student PII is not used to train models |
FERPA-aligned audit logging
Ember logs access to student education records so districts can investigate who viewed grades, submissions, or exports. Administrators can review activity from the Compliance Center in the Ember admin dashboard and export reports for their records retention policy.
Typical logged actions include read access to gradebooks and submissions, bulk exports, and record deletions governed by district policy.
Encryption
| Layer | Commitment |
|---|---|
| In transit | TLS 1.2+ for all web and API traffic |
| At rest | AES-256 for databases and object storage in production |
| Secrets | Managed through secure environment configuration — never embedded in client apps |
Administrator MFA
Organization administrators are required to enable multi-factor authentication before accessing sensitive admin functions. Teachers and students may use district SSO where configured.
Incident response
Security events follow our documented Incident Response process, including FERPA breach assessment and district notification timelines aligned with your DPA.