HECVAT 4.1.6 - Blended Teaching - October 2026.xlsx

	A	B	C	D	E	F	G
2	HECVAT™ Solution Provider Response - Start Here					Version 4.1.6
3	Date Completed		10/9/2026
4	Instructions for Solution Providers
5	1. Complete the "Start Here" tab and review the "Required Questions" guidance to find the other sections are required for your product or service.
6	2. Complete the "Organization" tab and the applicable questions in each of the next 5 tabs (Product through Privacy) that apply, based on your answers to the "Required Questions."
7	3. Guidance in column E may change based on your answers to prompt details in "Additional Information." If leaving an answer blank, you must also state why in "Additional Information".
8	4. DO NOT complete any fields in the "Evaluation" sheets or the "Analyst Notes" column.
9	5. Return the completed file to institutions.
10	* Denotes critical questions. Critical questions are those deemed most important to institutions by higher education volunteers.
11	For full instructions, please visit educause.edu/HECVAT
12	General Information
13	GNRL-01	Solution Provider Name	Ascension Education, Inc. (d/b/a Blended Teaching)
14	GNRL-02	Solution Name	Blended Teaching (Library, Mayflower LMS integration, Educators portal)
15	GNRL-03	Solution Description	Blended Teaching provides digital course materials (textbook content, video lectures, practice and assessment questions) designed by educators for university students. Students use the Library app and Mayflower, which is embedded in the institution's LMS via LTI 1.3; instructors use the Educators portal to manage courses, assessments, grading and analytics, including optional AI-assisted features.
16	GNRL-04	Solution Provider Contact Name	Andrew Snead
17	GNRL-05	Solution Provider Contact Title	Chief Technology Officer
18	GNRL-06	Solution Provider Contact Email	andrew@blended-teaching.com
19	GNRL-07	Solution Provider Contact Phone Number	+1 (470) 569-2789
20	GNRL-08	Country of Company Headquarters	United States
21	GNRL-09	Employee Work Locations (all)	United States and United Kingdom
22	Company Information		Answer	Additional Information	Guidance	Analyst Notes
23	COMP-01	Do you have a dedicated software and system development team(s) (e.g., customer support, implementation, product management, etc.)?*	Yes	In-house software development team led by our Chief Technology Officer, with product management and customer support handled by the core team. We are a team of six.	Describe the structure and size of your software and system development teams. (e.g., customer support, implementation, product management, etc.).
24	COMP-02	Describe your organization’s business background and ownership structure, including all parent and subsidiary relationships.	Ascension Education, Inc. (d/b/a Blended Teaching) is a privately held Delaware corporation headquartered at 22 Trammell St SW B, Marietta, GA 30064, USA. Staff and contractors work in the United States and the United Kingdom. All institutions' data, including sign-in identity, is stored in the US (AWS and Supabase, us-east-1).		Include circumstances that may involve offshoring or multinational agreements.
25	COMP-03	Have you operated without unplanned disruptions to this solution in the past 12 months?	Yes	No significant unplanned outages in the past 12 months; only brief interruptions caused by upstream provider outages.
26	COMP-04	Do you have a dedicated information security staff or office?	Yes	Andrew Snead (CTO) is our designated Security Officer and leads the security programme, supported by the engineering team. Independent penetration testing is performed by an external firm at least annually (Vaadata; latest test June 2026, retest July 2026 with no open findings).	Describe your information security office, including size, talents, resources, etc.
27	COMP-05	Use this area to share information about your environment that will assist those who are assessing your company's data security program.	The platform is cloud-hosted. The web applications (Library, Mayflower, Educators) run on Vercel; the backend runs on AWS Lambda behind API Gateway and AWS WAF in us-east-1, with Amazon GuardDuty threat detection and CloudWatch alarms, and critical alerts page the on-call engineer 24x7. The primary database is Supabase PostgreSQL in us-east-1 with point-in-time recovery (restores tested regularly, most recently 7 October 2026). Sign-in uses Supabase Auth, hosted in AWS us-east-1 (US), since 30 September 2026. Auth0 has been retired. MFA is enforced for all administrative and privileged access and is mandatory for Educators and admins signing in directly. LMS integration uses LTI 1.3 (RS256 keys held in AWS Secrets Manager). All traffic uses TLS 1.2 or higher with HSTS; data at rest is encrypted with AES-256 (AWS S3, Supabase). Access to institutional data in the product is role-based. Our Security Officer is Andrew Snead (CTO) and our Privacy Officer and DPO is Phil Laney (CEO). An independent human-led penetration test (Vaadata, June 2026) found one High finding, which was fixed and verified closed at retest (report 3 August 2026, zero open findings). We are starting a SOC 2 program in October 2026 (auditor Sensiba LLP engaged; Type 1 testing scheduled for December 2026) and commit to an independent penetration test at least annually.		Share any details that would help information security analysts assess your solution.		End Table Data
28	Required Questions		Answer	Additional Information	Guidance	Analyst Notes
29	REQU-01	Are you offering a cloud-based product?	Yes	Software as a service hosted on Vercel, AWS and Supabase.	DO complete the Product and Infrastructure worksheets
30	REQU-02	Does your product or service have an interface?	Yes	Web interfaces for students (Library, and Mayflower embedded in the LMS) and for instructors (Educators portal).	DO complete the IT Accessibility worksheet.
31	REQU-03	Are you providing consulting services?	No		DO NOT complete the Consulting section in the Case-Specific worksheet
32	REQU-04	Does your solution have AI features, or are there plans to implement AI features in the next 12 months?	Yes	Educator AI features (an AI assistant for course analytics, written-answer grading support, question and content generation). Students' only interaction with AI is Intercom's AI support agent (Fin) in the support chat. We plan to let institutions switch Fin off for their Students by February 2027.	DO complete the Artificial Intelligence (AI) worksheet
33	REQU-05	Does your solution process protected health information (PHI) or any data covered by the Health Insurance Portability and Accountability Act (HIPAA)?	No		DO NOT complete the HIPAA section in the Case-Specific worksheet
34	REQU-06	Is the solution designed to process, store, or transmit credit card information?	Yes	Card payments are taken on Stripe-hosted Checkout; our systems never receive or store card data.	DO complete the PCI-DSS section in the Case-Specific worksheet
35	REQU-07	Does operating your solution require the institution to operate a physical or virtual appliance in their own environment or to provide inbound firewall exceptions to allow your employees to remotely administer systems in the institution's environment?	No	Integration is via LTI 1.3 configured in the institution's LMS. No appliance or inbound firewall exception is required.	DO NOT complete the On-Prem section in the Case-Specific worksheet
36	REQU-08	Does your solution have access to personal or institutional data?	Yes	Student and instructor names, email addresses, instructor phone numbers (optional, from bookstore orders only), LMS user IDs, course enrolments, grades, and student answers to course activities.	DO complete the Privacy tab		End Table Data
37	Note: The "Organization" tab is required for ALL products and services.
38	Copyright © 2025 EDUCAUSE
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104