Built for Compliance. Ready for Everything Else.

San Diego State University set out to solve a compliance problem — one with real financial stakes and federal scrutiny attached. What it discovered, over the course of implementing DataX through K16 Solutions, is that governed, independent access to institutional data delivers more than any single use case can anticipate.

This is the story of how a Title IV compliance initiative became a business continuity asset — and what that evolution means for how institutions think about their institutional data layer.

Federal Title IV financial aid regulations require institutions to document meaningful student engagement for all aid-eligible students. At SDSU, more than 20,000 students receive federal aid in some form. Two members of SDSU’s executive leadership team had firsthand experience with institutions that failed compliance audits, resulting in multi-million dollar federal penalties. Solving this was a non-negotiable institutional priority.

The challenge was architectural. Canvas and PeopleSoft — SDSU’s LMS and SIS respectively — had a one-way relationship. Enrollment data flowed from PeopleSoft into Canvas. Nothing meaningful flowed back. Everything that happened in between enrollment and final grades — assignment submissions, quiz completions, discussion activity, Zoom attendance — existed only within Canvas, with no automated path to the systems that needed it for compliance reporting.

SDSU evaluated multiple approaches, including Canvas Data 2 API integrations. None provided the student-level, course-level granularity that real compliance workflows require. DataX was the only solution that could.

By extracting data from Canvas’s API layer and application front-end, DataX gave SDSU complete visibility into engagement activity — processing over 12,000 events per day, standardizing them into a boolean engagement indicator, and publishing them back into PeopleSoft through a custom engagement roster that faculty could access, certify, and submit.

The solution went live on January 20, 2025 — 39 days after SDSU provided system access. A subsequent federal compliance review of the institution’s attendance tracking methodology found no issues.

“Going into a federal compliance review, you want to know your house is in order. DataX gave us that assurance. The reviewers examined our methodology closely, and we came through it without a single finding."

— James Frazee, Chief Information Officer, San Diego State University

In summer 2026, a significant security incident affecting the Instructure Canvas ecosystem prompted higher education institutions across the country to urgently reassess their LMS data resilience and business continuity posture. The questions were immediate and pointed: Could the institution still access its course data? Its student engagement records? Its operational reporting — if production Canvas access were compromised or unavailable?

For most institutions, the answer was unsettling. Standard APIs returned aggregate outputs with little operational value. Internal integration pipelines, where they existed, surfaced summary-level data that was insufficient for any real decision-making.

SDSU was in a different position. The DataX implementation that had been built for Title IV compliance had, in parallel, established an independent institutional data layer outside the production Canvas environment. The same governed access that supported engagement tracking also provided real course-level and student-level visibility into Canvas data — independent of what the production system was doing at any given moment.

“When Canvas went down, we quickly realized the value of having independent access to our data through DataX. We weren’t relying solely on standard APIs or limited reporting outputs; we had real visibility into the actual course and student-level data we needed.”

— Sean Hauze, Chief Operating Officer of IT, San Diego State University

The contrast with standard API outputs was stark. When SDSU’s internal teams pulled data through Canvas Data 2 during the incident, what came back were aggregate grade submission counts — a single number per course per day. DataX, by contrast, could show exactly which courses had which students, what they had submitted, and what their engagement status was. The difference between a number and an institutional record.

What SDSU’s experience demonstrates is something that more institutions are beginning to recognize: the data infrastructure required to meet compliance obligations is the same infrastructure required to maintain operational continuity when production systems are disrupted.

Governed, independent access to institutional data is not a separate project from compliance readiness or from resilience planning. It is the same investment, serving multiple institutional priorities simultaneously. An institution that builds this layer for Title IV reporting finds that it has also built it for business continuity. For audit readiness. For advising and student success. For AI-ready analytics. For institutional governance.

SDSU’s DataX implementation, originally scoped as a compliance solution, now serves as the foundation for a broader institutional data strategy. The institution is expanding faculty-level access to engagement data. It is integrating DataX insights into academic advising workflows. It is positioning the data layer as a foundation for future analytics and AI initiatives tied to SDSU’s institutional strategic plan.

“The security incident was a wake-up call for a lot of institutions, but for us, it was actually a validation. Because we had already built an independent data layer through DataX, we weren't scrambling to figure out what we had access to. The data we needed was there, it was current, and we could act on it. That's not something we planned for explicitly, but it's exactly why having the right data infrastructure in place before a crisis matters."

— James Frazee, Chief Information Officer, San Diego State University

For institutions evaluating their own institutional data strategy, SDSU’s experience offers a clear framework: start with a defined, high-stakes use case. Build it on a governed, independent data infrastructure. Then watch how that foundation extends further than you originally planned.

“The recent Canvas incident reinforced the importance of institutional data resilience and business continuity planning. Having DataX already in place gave us confidence that we had independent visibility into our LMS data and a stronger foundation moving forward.”

— Sean Hauze, Chief Operating Officer of IT, San Diego State University