What to ask any learning vendor

Privacy: NY Education Law 2-d and Part 121

• 1. What student personally identifiable information (PII) will you collect, and why?
  The vendor's answer (your notes)
  How Goal100 answers: Today: none. No student accounts; progress stays on the device and a student shares it with a code. With school accounts under a signed agreement: the minimum (nickname, class, scores, settings). No student email, birthday, last name, photo or voice. Where Goal100 says it: Security questionnaire · DPA template
• 2. Will you sign our data privacy agreement, with the Parents' Bill of Rights and supplemental information (Part 121.3)?
  The vendor's answer (your notes)
  How Goal100 answers: Goal100 offers one standard School and District DPA based on NYSED's model; supplemental information is in Student Data Privacy §6; your district attaches its own Parents' Bill of Rights. No agreement has been signed with a New York district or BOCES yet. Where Goal100 says it: Vendor packet · DPA template · BOCES review page
• 3. Do you sell student data, show ads, use data for marketing, or use it to train AI?
  The vendor's answer (your notes)
  How Goal100 answers: No. No ads, no tracking cookies, no analytics. Student data is never sold, never used for marketing and never used to train AI. Where Goal100 says it: Security questionnaire · Student Data Privacy
• 4. Where is data stored, and who are your sub-processors?
  The vendor's answer (your notes)
  How Goal100 answers: United States only. Hosting and database providers only (for example Netlify and Supabase), bound in writing to the same duties; the district gets the list and notice before a new one receives protected data. Specific data-center regions: not published yet. Where Goal100 says it: Security questionnaire
• 5. How fast will you tell us about a breach (Part 121.10)?
  The vendor's answer (your notes)
  How Goal100 answers: In the most expedient way possible and no more than 7 calendar days after discovery, in the DPA template. Goal100 pays required notification costs when the breach is attributed to Goal100. Where Goal100 says it: Security questionnaire · DPA template
• 6. What happens to our data when the contract ends?
  The vendor's answer (your notes)
  How Goal100 answers: The district chooses: return in a common format (such as CSV) or transfer, then secure deletion within 60 days, with backups expiring within a further 35 days. Deletion is certified in writing. Where Goal100 says it: Security questionnaire · DPA template
• 7. Do you have a data security and privacy plan (Part 121.6)?
  The vendor's answer (your notes)
  How Goal100 answers: It is Exhibit C of the agreement, with its contents listed in DPA §12. The full plan text is not posted on the site yet. Where Goal100 says it: Security questionnaire · DPA template

Security

• 8. Which security framework do you follow? Do you have a written security program?
  The vendor's answer (your notes)
  How Goal100 answers: Practices aligned with the NIST Cybersecurity Framework 2.0. A written information security program (version 1.0, Nov 10, 2026) is summarized on the Security program page. A yearly written risk assessment is not done yet. Where Goal100 says it: Security questionnaire · BOCES review page · Security program
• 9. Do you have an independent audit (for example SOC 2) or a penetration test?
  The vendor's answer (your notes)
  How Goal100 answers: Not yet. No independent security assessment has been done. Where Goal100 says it: Security questionnaire · BOCES review page
• 10. How is data protected: encryption, sign-in, access?
  The vendor's answer (your notes)
  How Goal100 answers: Today: HTTPS on every page, a strict Content Security Policy that blocks outside scripts and trackers, and security headers. With school accounts: encryption at rest by the database provider, row-level security so each school sees only its own data, two-step sign-in for admins, least-privilege access and audit logs. Encryption algorithm and key-management details: not published yet. Where Goal100 says it: Security questionnaire · BOCES review page
• 11. Do you carry cyber liability insurance?
  The vendor's answer (your notes)
  How Goal100 answers: Not yet. There is no policy yet. Where Goal100 says it: Security questionnaire · BOCES review page
• 12. What are your backup and recovery targets?
  The vendor's answer (your notes)
  How Goal100 answers: The site is static files; a previous version can be put back from deploy history, with a 24-hour restore target. Backup and restore targets for account data: not published yet. Where Goal100 says it: BOCES review page · Security questionnaire

Accessibility

• 13. Do you meet WCAG 2.1 AA, the standard in the ADA Title II web rule?
  The vendor's answer (your notes)
  How Goal100 answers: Designed to WCAG 2.1 AA. Automated accessibility checks run across the site, and serious issues found were fixed in November 2026. No independent audit yet, so Goal100 does not claim full conformance. Where Goal100 says it: BOCES review page · Accessibility statement
• 14. Do you have an Accessibility Conformance Report (VPAT® format)?
  The vendor's answer (your notes)
  How Goal100 answers: Not yet. Where Goal100 says it: BOCES review page
• 15. How does it work with a keyboard, a screen reader, captions and motion settings?
  The vendor's answer (your notes)
  How Goal100 answers: Keyboard use, visible focus, skip links, a Listen button, text size, easy-read font, high contrast, dark mode and calm (no motion) mode. Every 3D scene has a text or alternative version. Known limit: some 3D scenes and games are hard to use with a screen reader (each has a text alternative). Where Goal100 says it: BOCES review page · Accessibility statement

Curriculum fit

• 16. Is it aligned to New York State learning standards? Where can we see the codes?
  The vendor's answer (your notes)
  How Goal100 answers: Built on NYS Next Generation Mathematics and ELA, NYSSLS science, the NYS K-12 Social Studies Framework, NYS Arts, Health, PE, LOTE and Computer Science and Digital Fluency standards. Every course shows its standards inside, lesson by lesson. Where Goal100 says it: BOCES review page
• 17. Does it follow our pacing calendar?
  The vendor's answer (your notes)
  How Goal100 answers: Lessons are in the order of the standards, and teachers choose the order they need. Most schools do not publish their pacing calendars. Where Goal100 says it: BOCES review page
• 18. What evidence shows it works (ESSA levels)?
  The vendor's answer (your notes)
  How Goal100 answers: There is no outcome study yet and no classroom pilot results yet. An evidence and logic model is the base for ESSA evidence level IV (“demonstrates a rationale”), and a free pilot plan with measures is ready to run. Where Goal100 says it: BOCES review page · Pilot
• 19. How does it support English learners and students with IEPs?
  The vendor's answer (your notes)
  How Goal100 answers: The teacher side of lessons lists supports for English learners and students with IEPs. The website, menus, help lines and big ideas are in Spanish; full Spanish lessons are not in every course yet. Where Goal100 says it: BOCES review page

Rostering and how it connects

• 20. Do you support automatic rostering (OneRoster) and single sign-on (Clever, ClassLink, Google)?
  The vendor's answer (your notes)
  How Goal100 answers: Not available. Today there are no student accounts, so there is nothing to sign in to. A teacher can open OneRoster 1.1 CSV files in the browser to make a class list on the device; nothing is uploaded. Where Goal100 says it: Security questionnaire · BOCES review page · OneRoster class list
• 21. Does it work with our learning management system? Grade passback or LTI?
  The vendor's answer (your notes)
  How Goal100 answers: Every lesson has its own web address to post in any learning management system or class page. Grade passback and LTI: not available. Where Goal100 says it: BOCES review page
• 22. Will it run on our managed Chromebooks and content filters?
  The vendor's answer (your notes)
  How Goal100 answers: Web pages only: no install and no extension. Only Goal100's own site needs to be reachable. Where Goal100 says it: BOCES review page
• 23. How do teachers see student progress?
  The vendor's answer (your notes)
  How Goal100 answers: Students send a “Send to my teacher” progress code; the teacher reads mastery without any student account. A class dashboard is not available. Where Goal100 says it: BOCES review page

Cost and contract

• 24. How is it priced, and can we get a written quote?
  The vendor's answer (your notes)
  How Goal100 answers: Per student, per year, for a school or a whole district. Prices are on the Plans page; the instant quote makes a dated, printable quote. The Free Preview (lessons 1 to 3 of every course) needs no account. Where Goal100 says it: Plans · Instant quote
• 25. Can we pilot it without a contract?
  The vendor's answer (your notes)
  How Goal100 answers: Yes. A pilot uses the Free Preview, needs no contract and no student data, and either side can stop at any time. Where Goal100 says it: Pilot · Vendor packet
• 26. Can you send a W-9, a business address and a certificate of insurance?
  The vendor's answer (your notes)
  How Goal100 answers: Not ready yet: business mailing address and phone, and a certificate of insurance (no policy yet). IRS Form W-9: sent on request (not posted). Where Goal100 says it: BOCES review page · Vendor packet