Quality you can see. Compliance you can check.
Every lesson, quiz, and activity passes the same set of gates before a student ever opens it. No piece of content reaches a child without clearing structure checks, a language scan, and a human review step.
Three gates, every single time
Content moves through these stages in order. A piece that fails any gate doesn't move forward — it's regenerated or held for a reviewer.
Generated
Built to a strict shape, then checked automatically
Structure validation
Every lesson, quiz, tutorial, and experiment must match a fixed structure before it is saved. Anything malformed is regenerated, never published. A quiz that isn't a complete set of well-formed questions simply does not ship.
Inclusive-language scan
All content is scanned for non-inclusive or insensitive language before it can be approved. Flagged passages must be cleared by a reviewer — they cannot be skipped.
Age-appropriate & on-level
Content is restricted to academic topics for Grades 5–12 and is generated to read 1–2 grade levels below the student's grade, so the focus stays on understanding.
Reviewed
A person approves it before any student sees it
Human approval gate
Newly generated content starts as 'pending'. It only becomes visible to students after a reviewer explicitly approves and publishes it. Rejected or blocked content is held back, and any published version can be rolled back.
Side-by-side & annotated review
Reviewers read the content unit by unit, leave notes against any section, and compare versions with word-level highlighting — so changes between revisions are never invisible.
Warnings must be resolved
Language-scan warnings are tracked individually. A version can't be approved until every warning is either fixed or explicitly marked as a reviewed false positive.
Served safely
Privacy and access rules are enforced by the platform
Records stay inside your school
Progress, scores, and history are treated as educational records. Access is scoped to the student's own institution at the database level — one school can never see another's records.
Consent before access
Students under 13 require verifiable parental consent before their account is activated. Until then, content access is blocked. We collect only the minimum information needed to run the service.
Built per language, not machine-translated
English, French, and Spanish content is each generated and reviewed on its own. We don't run AI output through a translator and hope for the best.
The standards we hold ourselves to
The full list of accessibility, privacy, security, and content standards we comply with or actively target. We label honestly: Compliant means in place today; Target means we build to it and verify continuously, with an audit still in progress.
Accessibility
WCAG 2.2 Level AA
TargetW3C Rec — October 2023
The 2023 update to WCAG that adds nine new success criteria. Implemented: SC 2.4.11 Focus Not Obscured (scroll-padding-top prevents sticky nav from hiding focused elements); SC 2.5.8 Target Size Minimum (all interactive elements ≥ 24×24 px); SC 3.2.6 Consistent Help (Privacy, Accessibility, and Contact links appear in the same footer location on every page); SC 3.3.8 Accessible Authentication (no CAPTCHA or cognitive test on any auth flow). Remaining criteria are being audited.
WCAG 2.1 Level AA
TargetW3C Rec — June 2018
Full web-portal compliance with all Level A and AA success criteria including perceivable, operable, understandable, and robust requirements. Verified automatically on every build with axe-core (WCAG2A + WCAG2AA + best-practice rule sets).
Dyslexia-Friendly Font — OpenDyslexic
CompliantOpenDyslexic v3.003
Students can switch body text to OpenDyslexic via Settings. The preference is persisted in a cookie so the server-side render applies the correct font before React hydrates — eliminating any flash of unstyled text.
Windows High Contrast / Forced Colors Mode
CompliantCSS4 · WCAG 2.1 SC 1.4.11
A dedicated @media (forced-colors: active) block ensures all interactive elements, status badges, and focus rings remain visible when the OS overrides author colours with the system palette (ButtonText, Highlight, GrayText).
Colour Contrast — 4.5:1 Normal Text / 3:1 Large Text
TargetWCAG 2.1 SC 1.4.3
All text–background combinations meet or exceed the AA contrast thresholds. The OKLCH perceptually-uniform colour space is used throughout so contrast values are accurate across display profiles.
Screen Reader Support (WAI-ARIA 1.2)
CompliantW3C Rec — June 2023
Interactive widgets use correct ARIA roles, aria-label, aria-hidden, and aria-invalid attributes. Decorative icons are hidden from the accessibility tree. Live regions (role="status") announce time-sensitive updates such as the demo countdown banner.
Keyboard Navigation — Focus Visible
CompliantWCAG 2.1 SC 2.1.1 + 2.4.7
All interactive elements are reachable via Tab and have a visible focus ring (:focus-visible). A skip-to-main-content link at the top of every page lets keyboard users bypass repeated navigation.
Section 508 of the Rehabilitation Act
CompliantUS Federal — 2018 Refresh
US federal accessibility standard for ICT, required for procurement by federal agencies and publicly funded educational institutions. The technical standard for web content references WCAG 2.0 Level AA; our WCAG 2.1 AA compliance exceeds this requirement.
EN 301 549 v3.2.1
CompliantETSI — August 2021
European standard for accessibility requirements for ICT products and services. Required for EU public-sector procurement under the European Accessibility Act (Directive 2019/882). References WCAG 2.1 AA for web content — satisfied by our existing WCAG 2.1 AA compliance.
AODA — Accessibility for Ontarians with Disabilities Act
CompliantOntario, Canada — IASR, January 2012
Ontario law requiring public-facing websites to meet WCAG 2.0 Level AA and publish an Accessibility Statement with a feedback mechanism. Our WCAG 2.1 AA target exceeds the WCAG 2.0 AA minimum. An Accessibility Statement is published at /accessibility with a dedicated feedback email.
Android TalkBack / iOS VoiceOver
TargetWCAG 2.1 Mobile Guidance
PSA and notification content is authored to be fully readable by TalkBack (Android) and VoiceOver (iOS) through semantic HTML, ARIA labels, and no information conveyed by colour alone.
Privacy & Legal
COPPA — Children's Online Privacy Protection Act
CompliantFTC Rule — amended 2013
Students under 13 require verifiable parental consent before account activation. No data is collected until account_status = 'active'. Only the minimum necessary PII is collected (name, email, grade, locale). No location data, device IDs, or behavioural fingerprinting.
FERPA — Family Educational Rights and Privacy Act
Compliant20 U.S.C. § 1232g · 34 CFR Part 99
Student progress records, quiz scores, and lesson-view history are treated as educational records. Teacher and admin endpoints are scoped to the student's own institution. JWT secrets are separate for students, teachers, and internal staff so roles cannot be forged or crossed.
GDPR — Right to Erasure
CompliantEU 2016/679 · Art. 17
Deleted student accounts are anonymised within 30 days: the student_id foreign key is stripped from progress records. No student data is shared with third parties without explicit consent.
SOPIPA — Student Online Personal Information Protection Act
CompliantCalifornia — January 2016
Prohibits operators of school-related websites from using student data for targeted advertising, building profiles for non-educational purposes, or selling student information. StudyBuddy collects no advertising identifiers, performs no behavioural profiling, and shares student data only with sub-processors necessary to deliver the educational service (Auth0, AWS, SendGrid). A dedicated SOPIPA section is included in the Privacy Policy.
CCPA / CPRA — California Consumer Privacy Act
CompliantCalifornia — amended by CPRA, January 2023
Grants California residents the right to know, delete, and opt out of the sale or sharing of their personal information. StudyBuddy does not sell or share personal information as defined under CCPA. A 'Do Not Sell or Share My Personal Information' statement and contact details for exercising rights are included in the Privacy Policy.
Security
PCI DSS SAQ-A
CompliantPCI SSC v4.0 — March 2022
Payment card security standard. StudyBuddy uses Stripe Checkout (redirect model) — no card data ever touches our servers or passes through our application code. This limits scope to SAQ-A (the lowest-burden self-assessment questionnaire). Stripe holds PCI DSS Level 1 certification; our obligation is to complete and retain the SAQ-A annually.
Content
Age-Appropriate Content — Grades 5–12
CompliantUK Age Appropriate Design Code (2021)
All AI-generated lessons, quizzes, and experiments are restricted to academic STEM topics. Content is reviewed by AlexJS for inclusive language before publication. Error messages exposed to students are non-technical and age-appropriate.
Reading-Level Accessibility
CompliantFlesch-Kincaid · CAST UDL Guidelines
Lesson content is generated at 1–2 grade levels below the student's actual grade to maximise comprehension. PSA and emergency notifications target Flesch-Kincaid Grade 8 or below with multi-channel delivery (text + audio + visual).
Inclusive Language
CompliantAlexJS v11
All AI-generated content passes AlexJS analysis before publication. Gender-neutral phrasing is enforced for professional roles. No gendered emoji in diagrams or examples.
EU AI Act — Transparency Obligation (Art. 50)
CompliantEU 2024/1689 — in force August 2024
AI systems that generate or manipulate content must inform users that the content is AI-generated. An AIContentDisclosure notice is rendered at the bottom of every lesson, quiz, tutorial, and experiment page, stating that content was generated by the StudyBuddy AI pipeline and reviewed before publication.
Internationalisation
Multi-Language Support (EN / FR / ES)
CompliantISO 639-1 · next-intl 4.8.3
All student-facing UI strings are fully translated into English, French, and Spanish via next-intl. AI-generated lesson content is built separately per language by the content pipeline — no machine translation of AI output. Students switch locale in Settings; the preference is stored in the JWT.
HTML lang Attribute
CompliantWCAG 2.1 SC 3.1.1
The <html lang="…"> attribute is set server-side from the user's active locale so screen readers announce content in the correct language without guessing.
Reviewing our setup for procurement? Ask us for the compliance one-pager →
What this means for you
For parents
Your child sees academic content that an adult has reviewed and approved — not raw AI output. Under-13 accounts stay locked until you give consent, and we collect only name, email, grade, and language.
For teachers
What you assign has already cleared structure and language checks and a human approval step. You can customize and re-review your school's content, and nothing changes underneath students without a tracked version.
For school & district admins
Records never cross school boundaries, content carries an audit trail from generation to publish, and the standards above map cleanly onto FERPA, COPPA, and WCAG line items in your procurement checklist.
Have a compliance question?
We're happy to walk your team through any gate or standard on this page — and to share documentation for your procurement review.