# LumiPad school/district pilot deployment pack — draft

Last verified: 2026-08-23
Status: pilot-readiness baseline; legal and operator review required before signature.

This document is not legal advice, a signed statement of work, or an active service-level agreement. Replace every `[TO COMPLETE]` field in the order form and have both parties approve the final scope.

## 1. Pilot outcome and guardrails

- Name one accountable school/district sponsor, one LumiPad operator, one privacy contact and one technical contact.
- Define a bounded cohort, dates, allowed data classes and success measures before onboarding.
- Default to minimum data: school, class, role and login identifier. Do not upload special-category or unnecessary child data.
- Keep optional AI disabled until the Gemini paid-service/DPA/eligibility gate is cleared in writing.
- Do not claim Vietnam data residency, LumiPad ISO/SOC certification, an active contractual uptime SLA, private cloud or on-prem delivery.

## 2. Proposed RACI

| Activity | School/district | LumiPad operator | Joint |
|---|---|---|---|
| Lawful basis, notices and guardian/child consent where required | Accountable | Consulted | Review |
| Tenant configuration and least-privilege roles | Approves | Implements | Test |
| Source export quality and identity mapping | Owns | Supports | Reconcile |
| Incident triage | Notifies locally | Investigates platform | Communicate |
| Data-subject requests | Validates requester | Executes platform workflow | Track |
| Exit export and deletion authorization | Approves | Executes and evidences | Sign off |

## 3. Four-gate delivery sequence

1. **Discover:** inventory source boards, account model, data categories, retention, integrations and accessibility needs.
2. **Configure:** isolate the tenant, assign representatives, configure origin/storage/realtime controls, disable unnecessary providers and record exact hosting regions.
3. **Migrate and accept:** import only through supported preview flows, reconcile counts/checksums, run role/access tests, browser/mobile/accessibility smoke tests and obtain named sign-off.
4. **Operate and exit:** monitor incidents and adoption, conduct weekly review, export at exit, freeze changes when authorized, then run the governed deletion workflow.

## 4. Padlet and roster migration checklist

- Export Padlet data to supported CSV/XLSX/ZIP and preserve the original read-only source export.
- Map source owners to verified LumiPad educators; never infer student ownership from display names alone.
- Use LumiPad import preview, resolve rejected rows and approve the destination school/board before commit.
- For large ZIP jobs, use resumable import and reconcile the manifest, row counts, attachment counts and reported checksum.
- Import rosters from the reviewed CSV template, preview duplicates and reserved identifiers, then obtain school approval.
- Sample text, Unicode, dates, links, attachments and permissions. Record exceptions instead of silently dropping them.
- Keep the source system unchanged until acceptance and rollback expiry. No direct database import is supported.

## 5. Acceptance evidence

- Correct tenant and roles; outsider and cross-tenant access denied.
- Required boards/posts/files imported with count reconciliation and exception log.
- Export is readable; deletion preflight is non-destructive and lists blockers.
- Desktop and 390 px mobile critical journeys pass; keyboard navigation and automated accessibility report reviewed.
- Runtime/database/blob regions and enabled optional providers copied from the live operator dashboards into the signed order form.
- Backup/rollback owner, deadline and communication tree agreed.
- Complete the restricted evidence card and isolated restore drill in [`disaster-recovery-runbook.md`](./disaster-recovery-runbook.md); a source-level runbook alone is not recovery evidence.

Live operator verification on 2026-08-26 recorded Vercel Functions in `iad1`, Private Blob in `IAD1`, and Neon Free/PostgreSQL 18 in AWS US East 2 (Ohio) with six-hour history. The database rehearsal met the internal 6-hour RPO and 30-minute RTO targets. Blob retention/version recovery is `unavailable` in the live dashboard, so the signed order form must not promise attachment recovery until an independent replica/export exists. The Vercel DPA and final provider/subprocessor classification still require customer/legal approval.

## 6. Exit and rollback

Before cutover, rollback means deleting only the isolated LumiPad pilot fixture and returning to the unchanged source. After acceptance, the school requests an export, verifies it, authorizes the retention/deletion path and receives the available audit evidence. LumiPad does not promise recovery beyond the signed retention and backup terms.