QueryTek™

Documentation / Platform glossary

Platform glossary

Alphabetical list of published platform terms. Only review-approved articles appear here.

  • Allowlist

    An allowlist names what is explicitly permitted, and everything absent is refused. It is the inverse of a blocklist, wh…

  • API

    An application programming interface is a defined contract through which one system uses another's capabilities. The co…

  • Audit trail

    An audit trail is a durable, tamper-resistant record of who did what, to what, and when. It differs from application lo…

  • Blast radius

    Blast radius is the extent of what breaks when one thing fails — how many users, tenants, or capabilities are affected.…

  • Bounded context

    A bounded context is a boundary within which a set of terms has one consistent meaning. It comes from domain-driven des…

  • CCPA / CPRA

    The California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives California residents rights…

  • CDN

    A content delivery network is a distributed set of servers that serve content from locations near the user rather than…

  • Content Security Policy

    Content Security Policy is a browser security standard that lets a site declare which sources of script, style, images,…

  • Correlation ID

    A correlation ID is a unique reference attached to a request and carried through every service that handles it. It turn…

  • Data Encryption Key

    A data encryption key is the key that encrypts actual content — a document, a record, a file. It is the only key in an…

  • Data retention

    Data retention is the deliberate decision about how long each category of information is kept and what happens when tha…

  • Deny-by-Default

    Deny-by-default means access is refused unless something explicitly permits it. The alternative — allow unless a rule f…

  • Disaster Recovery

    Disaster recovery is the planned capability to restore service after a significant failure — a region outage, data corr…

  • Envelope Encryption

    Envelope encryption encrypts data with one key and then encrypts that key with another. The result is a chain of keys r…

  • Fail-closed / Fail-open

    When a control cannot reach a decision — the policy service is unavailable, a check times out — it must still do someth…

  • False positive

    A false positive is a legitimate case that a control incorrectly flags or restricts — a valid user blocked, a compliant…

  • FERPA

    FERPA — the Family Educational Rights and Privacy Act — is the United States federal law governing student education re…

  • GDPR

    The General Data Protection Regulation governs the processing of personal data of people in the European Union. It requ…

  • High availability

    High availability is designing a system so that expected component failures do not interrupt service. It assumes hardwa…

  • Identity provider

    An identity provider is the system an organization trusts to authenticate its people and vouch for who they are to othe…

  • ISO 27001

    ISO/IEC 27001 is an international standard for information security management systems. Rather than prescribing a fixed…

  • JSON Web Token

    A JSON Web Token is a compact, URL-safe format for transmitting signed claims between parties. It has three parts — hea…

  • Key Encryption Key

    A key encryption key encrypts other keys rather than data. Wrapping a data encryption key allows it to be stored next t…

  • LTI Advantage

    LTI Advantage is the set of services layered on LTI 1.3 that turn a one-way launch into a two-way exchange: the tool ca…

  • MEK / Master Key

    A master encryption key sits above the wrapping layer, protecting or deriving the keys that wrap data keys. It adds an…

  • Multi-tenancy

    Multi-tenancy is an architecture where one running application serves many customer organizations, each in its own logi…

  • OAuth

    OAuth 2.0 is an authorization framework that lets an application access resources on a user's behalf without handling t…

  • OpenId Connect

    OpenID Connect is an identity layer built on top of OAuth 2.0. Where OAuth answers what an application is permitted to…

  • PIPEDA

    Canada's Personal Information Protection and Electronic Documents Act governs how private-sector organizations collect,…

  • Role-Based Access Control

    Role-based access control grants permissions to roles rather than to individuals, and assigns people to roles. Access f…

  • Root Key / Root of Trust

    A root of trust is the point where a key hierarchy stops depending on something else. Every subordinate key derives its…

  • Row-level security

    Row-level security is a database capability that restricts which rows a given caller can see or modify, enforced by the…

  • Service Level Agreement

    A service level agreement is the contractual commitment a provider makes about service performance — typically availabi…

  • Single sign-on

    Single sign-on lets a person authenticate once with their organization's identity provider and then reach multiple appl…

  • SOC 2

    SOC 2 is an auditing standard for service organizations, developed by the AICPA, that examines whether a company's cont…

  • Tenant

    A tenant is the boundary that owns a customer's data, users, and configuration within a shared platform. It is the unit…

  • Tenant isolation

    Tenant isolation is the guarantee that one customer's data, users, and configuration remain unreachable from another's…

  • WCAG 2.1 AA

    The Web Content Accessibility Guidelines are the W3C standard for making digital content usable by people with disabili…

  • Webhook

    A webhook is an HTTP callback: when something happens in one system, it sends a request to a URL the subscriber registe…

  • xAPI

    xAPI, the Experience API, is a specification for recording learning activity as statements of the form actor–verb–objec…