Links
| Website: https://terracotta.education | Contact: info@terracotta.education |   |
| Location: Bloomington, Indiana | Release notes: https://github.com/terracotta-education/terracotta/releases |
About
Terracotta, a platform for experimental education research, enables research across education levels, student populations, and learning materials by embedding studies directly in Canvas. Terracotta supports teachers and researchers in assigning different versions of online learning activities randomly to students, collecting informed consent, and exporting deidentified study data. It this way, the platform lowers technical and methodological barriers to conducting rigorous and responsible experimental research within the environment where most learning and design currently take place: Canvas.
Accessibility
Terracotta is purpose-driven, and seeks to lower barriers to participating in research on student learning. We are steadfastly committed to ensuring that our web application is accessible to the broadest possible audience. Every frame in Terracotta is screened using the axe DevTools extension to test for common accessibility issues. As we grow, Terracotta aspires to comply with WCAG 2.1 AA standards both within the tool, and in our website and accompanying documentation.
Security
Terracotta is an open source web application, available under an Apache version 2.0 license. We welcome institutions to host their own instance of Terracotta, and in doing so, the host institution adopts responsibility for providing a secure environment. Responses to each item in the table below apply only to Terracotta hosting services as provided by Indiana University.
| HECVAT status | Full HECVAT complete and available |
| Data encryption | User authentication occurs exclusively using LTI 1.3. Data in transit are encrypted using TLS 1.2, and data at rest use AES-256, AWS’s default encryption in RDS. |
| Countries of data storage | US Only |
| Data storage method | Data are stored in the AWS cloud |
| Data retention policy | Data are retained as long as the institution's service agreement remains active. |
| Incident management program, policy, and testing | Our incident management plan is under development. |
| Disaster recovery and business continuity plan and testing | Our business continuity plan is available and updated annually. Our disaster recovery and testing plan is under development. |
| Security Standard Certificates | AWS SOC3 report is available here: https://d1.awsstatic.com/whitepapers/compliance/AWS_SOC3.pdf |
| Third party testing and security controls practices | Access to Terracotta infrastructure is controlled by Indiana University’s Access Management unit, which enforces two-step authentication and account expiration policies, and by Indiana University’s Cloud Services unit, which enforces account roles and privileges in AWS. |
Privacy
As noted above, Terracotta is an open source web application, available under an Apache version 2.0 license. Responses to each item in the table below apply only to Terracotta hosting services as provided by Indiana University.
| Privacy policy link | https://terracotta.education/privacy-policy |
| COPPA policy link | Under development |
| Privacy department/officer contact: | No dedicated privacy officer at this time. Contact info@terracotta.education |
| Types of data collected | Terracotta collects data about Canvas assignments (which are experimentally manipulated in Terracotta), and identifiable data about students. Specifically, the student’s name, username, user id, activity within Terracotta, grades earned in Terracotta, and any outcome scores appended by the teacher are stored in Terracotta. |
| Personally identifiable or personal data collected | Terracotta collects a student’s username and id, which are included in a Caliper event service available for an institution’s subscription. Additionally Terracotta collects a student user’s firstname and lastname to facilitate manual grading features for the teacher. |
| Data Deletion Request Process | Data are retained as long as the institution’s service agreement remains active. In experiments where informed consent is activated, students need to opt-in to have their data included in Terracotta exports. |
| Third Party Data Sharing & Opt-out | A core feature of Terracotta is that student data can be exported to a user with the Teacher role who has setup an experiment in a class site. These data exports are deidentified, no PII is included. If the teacher has enabled informed consent within the experiment, then students must opt-in to be included in exports. It is then the user’s responsibility to manage data appropriately, analogous to Canvas Gradebook exports. Beyond this, no data are shared with any third parties. |
| Cookies or Tracking Technologies used | No cookies or tracking technologies are used in Terracotta. |
| Analytics performed on Customer Data | No analytics are performed on user data at this time. |
| Data correlation practices | None |
| Privacy Certifications or Seals | None at this time. |
| Targeted Advertising using user data | Terracotta does not serve ads. |
| Privacy or data protection impact assessments | None at this time. |
| Privacy Law Compliance | Terracotta is FERPA compliant. |
Integration Instructions
Contact us at info@terracotta.education to discuss pilot service availability.
