Procurement and Security Packet

Prepared July 21, 2026

This packet summarizes LiberiaLearn's current enterprise readiness for Ministry, procurement, and security review. It distinguishes implemented controls from planned controls so reviewers can evaluate the live system without overclaiming.

Architecture Summary

LiberiaLearn is a Next.js application deployed on Vercel with Supabase/Postgres as the primary data store. Prisma is used for database access. Production health checks verify database access, migration state, AI configuration, and SMS runtime mode. SMS currently reports healthy in dry-run mode. If live provider credentials are present but not probe-verified, health labels that state as smsMode: "live_configured_unverified" rather than implying verified live delivery.

Access Control and Tenant Isolation

Role-based access control is enforced through authenticated server routes and permission checks. School admins and teachers are scoped to their school context. Guardians are scoped to linked learners. MOE dashboard views are read-only and aggregate by default. Authorized MOE exports can include pseudonymized school-cohort learner rows without names, emails, phone numbers, guardian contacts, or raw student identifiers.

Auditability and Exports

Audit logs, export records, and data-access logs exist for governance review. Audit logs are append-only in application code and protected by database immutability triggers. Compliance audit search and CSV export are implemented with role and permission checks. Aggregate governance exports for student performance, class summary, and monthly reporting are implemented. Some governed export job types remain partial and are listed as future-sprint work.

Safeguarding

Safeguarding-related records and review surfaces exist, and escalation status can be queried. Current safeguarding alerting is reactive and queryable rather than proactive. LiberiaLearn should not claim proactive safety notification until a real alerting workflow sends timely notifications to responsible reviewers and records delivery evidence.

Backup and Recovery

Current backups are nightly CSV stopgap exports to private Vercel Blob storage with 90-day pruning. This is not a full database backup or verified point-in-time restore posture. The procurement path should include the planned Supabase upgrade for managed backups and point-in-time recovery, followed by documented restore drills with real timings and row-count evidence.

Data Retention

Retention policy language is published, but automated retention enforcement is not yet implemented for the active-account-plus-2-years window. Current deletion and retention handling is manual and policy-bound. A scheduled purge or anonymization job with audit evidence is required before claiming automated retention enforcement.

SSO

Single sign-on is available on request and should be scoped once a specific institutional identity provider is named. Building SSO without a buyer-specified provider risks implementing the wrong protocol, claims mapping, and operational ownership model.