Every university IT department has a version of the same meeting. An academic arrives enthusiastic about a platform. Somewhere in the first ten minutes, someone asks the only question that actually determines the outcome: which system is the system of record?
If the vendor hesitates, the next six months are already decided. The evaluation becomes an architecture argument, then a data protection argument, and the academic who started it discovers that enthusiasm is not a procurement strategy.
So we will answer it first, in writing, before anyone has to ask.
The answer
Your LMS remains the system of record for grades and for the academic transcript. eLEA.to does not hold the official academic record and is not designed to.
Concretely:
- Final grading authority stays with Moodle, or Blackboard, or whatever your institution uses. eLEA.to does not write to the gradebook in its current release, and grade passback is a deliberately separate, optional module rather than a default behaviour.
- Transcript data residency stays with your LMS and your student information system.
- eLEA.to operates as an append-only competency tracking ledger. Assessment records are added and superseded, not silently overwritten; the change log keeps who changed what, when, and from what value.
- Integration is over LTI 1.3, with SAML or OIDC single sign-on and roster synchronisation. No parallel identity store, no separate password to reset.
This is a constraint we accept on ourselves, not a limitation we are apologising for. A platform that competes with your LMS for authority over grades is a platform that has to be governed as if it were your LMS.
Why a narrow scope is worth more to you than a broad one
The usual vendor instinct is to claim the widest possible footprint. For a system handling student assessment data inside a public university, the widest footprint is a liability for both of us.
A narrow, clearly bounded processing activity is:
- Describable in one paragraph in your Article 30 record of processing activities.
- Assessable in a reasonable amount of time. Where an impact assessment is required, a bounded purpose with a bounded data set is a document your DPO can complete, rather than an open-ended one that keeps growing.
- Straightforward to exit. If the relationship ends, what has to come back is a defined set of assessment records, not a partially authoritative copy of your academic record that now has to be reconciled.
- Easier to answer a subject access request against. The student's assessment record is in one place with a defined boundary.
What we process, and the answers we give in a questionnaire
Rather than make you extract these one at a time:
Roles
For platform data, the institution is the data controller and Nexint Systems, S.L. is the processor, under a data processing agreement meeting GDPR Article 28. For the marketing website at elea.to we are the controller, and that is a separate, much smaller processing activity described in our privacy notice.
Categories of data
Student and staff identifiers as supplied by your roster sync; assessment records including scores, entrustment levels and narrative feedback; competency mappings; access and change logs. Assessment records about a named student are personal data and some narrative feedback may be sensitive in effect if not in category, which is why the access model matters more than the field list.
Location and transfers
Production hosting is on Scaleway in EU regions. We do not transfer platform data outside the EEA. If we ever needed to, it would require a Chapter V transfer mechanism and a transfer impact assessment, and it would be a change to the processing agreement, not an operational decision taken by us.
Sub-processors
Disclosed in full in the processing agreement, with notice of changes. We will say something uncomfortable here because you are going to ask anyway: a supplier's sub-processor list is only as honest as its access control in practice. The question worth asking any vendor, including us, is not "who are your sub-processors" but "who has production access, and can you show me the access log". Ask it.
Tenant isolation
Architectural from the start rather than retrofitted. Institutions do not share a data space.
Accessibility
WCAG 2.1 AA is a build requirement on every surface, which for a Spanish public university is a legal obligation under Real Decreto 1112/2018 and a late-stage procurement blocker if it is discovered to be missing. We would rather be tested on it during evaluation than after signature.
Audit trail
An immutable change log of assessment records: who changed what, when, from what value. We describe this as change traceability and not as a cryptographic guarantee, because it is not one. If your legal office requires tamper-evidence with a cryptographic basis, say so in the evaluation, because it is a different engineering conversation with a different cost.
AI
AI-powered insights are available. They synthesise narrative feedback across a portfolio and surface what recurs across assessors and over time, configured around the questions a programme actually asks rather than shipped as a fixed set of dashboards.
Here is the part your DPO will want in writing. Each AI capability goes live only after its own data protection impact assessment and an EU AI Act evaluation; it is switched on by the institution rather than arriving in a platform update; and the evidence behind any generated insight stays readable in full, so a committee can check the synthesis against the record rather than take it on trust. We treat automated inference about a student's progression as a change in the risk profile of the system, not as a feature increment, and we document it that way.
Two things follow that are worth stating before you have to ask. An insight is not a decision: nothing in the platform makes or recommends a progression outcome, so no decision with legal or similarly significant effects is taken by automated means and article 22 of the GDPR is not engaged. And if your institution would rather not enable AI at all, the platform runs without it — the assessment loop described above does not depend on it.
Where we are weaker than we would like
An honest procurement answer includes the parts that are not yet strong, because you will find them anyway and finding them yourself is much more expensive for us.
We are a small company. Concentration risk and key-person risk are real and you should price them. What we can offer against that is escrow, documented exit migration support, and export formats that are useful without us. What we cannot offer is the balance sheet of a large vendor, and you should not let anyone talk you out of weighting that.
Our support model is the binding constraint on several of our SLA commitments. Breach notification, restore time and subject access request turnaround all depend on the same support capability. If you are evaluating us, ask specifically how severity-1 incidents are escalated outside business hours and what the actual response commitment is, rather than accepting a single published response time that was written for ordinary tickets. We would ask that of a supplier and we would expect you to ask it of us.
Deep LMS integration is a module, not core. LTI 1.3, SSO and roster sync are in the base product. Grade passback, content sync and SIS connectors beyond Moodle are add-ons with implementation effort attached. If your evaluation assumes deep bidirectional integration as standard, the scope and the price are both different, and it is better to find that out now.
The five questions we would ask a vendor in our position
- Which system is authoritative for grades, and is the answer written into the contract or only into the sales deck?
- Who has production access to our tenant, and can you produce the access log?
- What exactly is in the exit package, in what format, and have you ever actually run an exit?
- What is the escalation path and response commitment for a severity-1 incident outside business hours?
- Which advertised features are not in the current release, and where is that written down other than in this conversation?
We would rather you asked us all five early. A vendor that answers them badly in month one costs you a meeting. A vendor that answers them badly in month nine costs you a term.
References and instruments
- Regulation (EU) 2016/679 (GDPR), Articles 28, 30, 32 and Chapter V.
- Regulation (EU) 2024/1689 (EU AI Act).
- Real Decreto 1112/2018 on accessibility of public sector websites and applications.
- IMS Global / 1EdTech Learning Tools Interoperability (LTI) 1.3 and LTI Advantage.
- Esquema Nacional de Seguridad, Real Decreto 311/2022.