Compliance
A standards-driven approach your review board can work with
Bringing a new tool into teaching means bringing it through review: security questionnaires, privacy assessments, accessibility checks, and procurement policies that differ from one institution to the next. Annoto is built and operated with that reality in mind. Rather than treating compliance review as an obstacle, we treat it as part of the product — the process is smoother when a vendor arrives organized, transparent, and already speaking your reviewers' language.
Anchored in recognized frameworks
Our security and privacy practices are organized around widely used industry frameworks and the expectations institutional review boards apply to education technology. Controls are documented, access is role-based and least-privilege, and changes to the platform go through defined review. Because Annoto integrates through LTI 1.3 with Canvas, Moodle, Blackboard, Brightspace, and Open edX, identity and enrollment stay governed by your LMS — Annoto inherits your roles rather than inventing a parallel account system.
Privacy and data minimization
Annoto processes learner data for one purpose: making video learning work. Discussions, quiz responses, notes, and attention and comprehension analytics exist to serve instructors and students in the course, and analytics export and completion and gradebook sync move data along paths your institution controls. We collect what the pedagogy requires and no more, and we are explicit with reviewers about what is stored, where, and for how long.
Documentation for your reviewers
Security overviews, data-processing descriptions, and architecture documentation are available on request to support vendor assessments, and our technical documentation at docs.annoto.net covers integration details your IT team will want early. If your process uses a standard questionnaire, we will complete it; if it needs a call between your security team and ours, we will schedule one. Questions from review boards get direct answers, not marketing language.
Institutions worldwide have taken Annoto through procurement, security review, and privacy assessment, and each round has made our answers sharper and our documentation better. If you are starting that process now, contact us early — we can usually shorten it by giving your committee exactly what it needs in the first exchange rather than the fourth.
What a typical review actually involves
Most institutional reviews of Annoto follow a familiar arc: a security questionnaire, a data-flow description showing what moves between the LMS and Annoto over LTI 1.3, a privacy assessment against your local regulations, and sign-off from whoever owns LMS integrations. The useful early step is scoping. Because authentication stays with your LMS, Annoto never receives institutional passwords, and the data exchanged is limited to what the integration needs, so reviewers can concentrate on the actual surface rather than a hypothetical one. We supply the data-flow description in the first exchange so your committee scopes from evidence, not assumption.
Accessibility questions, answered upfront
Review boards increasingly weigh accessibility alongside security, and video tools get particular scrutiny. Annoto's interaction layer is designed to work with the assistive technologies your students already use, and captions remain a function of the underlying player — Kaltura, Panopto, YouTube, Vimeo, or Wistia — so existing captioning workflows continue unchanged. Notes and AI summaries give students additional ways into the same material beyond the video itself. Accessibility documentation is available on request in the format your review process expects, and where a committee raises a specific barrier, we treat it as a finding to address, not an objection to argue with.
Responsibilities after the approval
Approval is a snapshot; operating responsibly is ongoing. The division of responsibility stays clean: your institution governs identity, enrollment, roles, and retention decisions, while Annoto operates the service within the boundaries your review approved. When something material changes on our side — architecture, sub-processors, data handling — we tell you rather than letting your next annual review discover it. Institutions that re-assess vendors on a yearly cycle can request refreshed documentation each round, and exports over CSV or API mean your data remains portable for the entire life of the contract, including its end.
