Proposal to NAIS: DASL API Access for NYSAIS

Draft — for internal reference and adaptation before sending

Opening angle

We're a NAIS-member state association building tools that surface DASL insights inside the workflow our schools already use — staff visits, accreditation, board reporting, admissions planning. Every insight we render is either aggregated (never single-school) or shown only to a school's own users viewing their own record. We're not building a competing benchmarking product; we're building a distribution layer for DASL data our schools already own.

Our platform (what we've already built)

NYSAIS runs seven production web applications at nysais.org:

• Professional Learning (PL): event registration, session catalog, presenter management
• Sponsors: sponsor portal, package management, invoicing
• Staff: internal CRM, visit tracking, accreditation cycles, DASL Tracker
• Check-in: on-site event check-in with Raspberry Pi kiosks and badge printing
• Jobfair: candidate/school portal for the annual educator jobfair
• Live Captioning: real-time captions for conferences and events
• QR service: self-hosted QR code generation

These serve ~200 member schools plus board, staff, presenters, and vendors. Data is integrated across school profiles, staff visits, accreditation cycles, registration history, and (currently via manual XLSX exports) DASL Full/Provisional membership status.

The DASL Tracker (shipped September 2026) is already a staff-facing tool that ingests DASL exports and tracks Full and Provisional members alongside our internal accreditation state. API access would replace a manual upload step, not build something new.

Infrastructure (why we can be trusted with the data)

• Dedicated staging/production split across three servers with automated deploy pipelines
• Nightly automated backups to two independent providers (AWS S3 + Backblaze B2)
• CI/CD via GitHub Actions, tag-gated production releases, direct-push to main branch server-side rejected — every change is a reviewed PR
• Zero manual SSH to production — all changes flow through the deploy pipeline
• Ubuntu Pro with livepatch for zero-downtime kernel CVE remediation
• Automated security patching (unattended-upgrades), ClamAV virus scanning, fail2ban, UFW firewall
• Application-layer security on every app: Helmet, CORS, rate limiting, audit logging
• Auth: Google OAuth restricted to @nysais.org domain for staff; magic-link auth for school users; MFA-gated Tailscale VPN for admin access
• Sentry error monitoring, documented disaster recovery procedures
• PostgreSQL 16 with dedicated per-app databases and per-app credentials
• Nightly PII sanitizer scrubs sensitive fields from production data before staging copies are made

Our API integration standards

If granted access, we'd integrate as follows:

• Read-only, single scheduled ingest (nightly or weekly), not on-demand queries — respectful of rate limits
• Disk cache all responses; refresh only when DASL publishes new data
• Audit log every API call with timestamp, endpoint, purpose, and invoking service account
• Secrets never in code — API key stored in .env files with restricted filesystem permissions, rotated on a schedule
• Named service accounts — separate credentials for DASL Tracker and data.nysais.org (if approved), so access can be revoked granularly
• Aggregation-first storage: for public analytics surfaces, only k-anonymized rows (minimum 5 schools per cell) are written to the public tables — raw per-school data never leaves staff-only tables
• Respects DASL's own permission model: if a school hasn't consented to inter-school benchmarking, they don't appear in cross-school aggregates
• Willing to sign a data use agreement and provide quarterly access logs on request

What we'd build with API access

Immediate (already shipped, just needs API):

1. DASL Tracker auto-refresh — the tool currently ingests XLSX exports uploaded by staff. API access removes that step, gives staff a live view of DASL membership state alongside our accreditation records.

Planned:

2. data.nysais.org — regional analytics site combining DASL admissions/enrollment data with US Census demographics (ACS 5-year) at neighborhood, borough, and region resolution. Strict k-anonymity (never render a cell backed by fewer than 5 schools). Staff-only in v1; per-school-scoped access for member schools in v2. Never exposes single-school data.

Why this helps NAIS

• Increases DASL's demonstrable value to member schools — they see it live, integrated with tools they use every week, not as a once-a-year benchmarking report
• Reference implementation for other state associations — there are 23 of us, and NYSAIS is one of the more technically-mature. This pattern could scale.
• Higher DASL renewal and adoption through visibility — schools that see their DASL data surface in state-association tooling are more likely to keep subscribing
• NAIS remains the authoritative source — we're a distribution and analysis layer, not a competitor

The concrete ask

1. Read-only DASL API access for NYSAIS, scoped to our member schools' data
2. If full access is a concern, we'd accept a limited scope (e.g., aggregated state and region rollups, or just the DASL-status endpoint we need for the tracker)
3. A data use agreement we can sign
4. A named technical contact for integration questions
5. Optional: pilot arrangement with clear evaluation criteria after 6-12 months

Contact: Andrew Cooke, andrew@nysais.org