School guide — Shield DNS filtering & Sentinel safety monitoring

Overview

Shield is your school's intelligent web protection and student safety monitoring platform. Your IT partner (MSP) set up Shield for you, and now your counselors, administrators, and staff use the school portal at app.theonestack.com/portal/shield to respond to safety alerts, review DNS activity, and manage parent accounts.

Shield has two parts:

• Shield DNS — Runs silently in the background on every device, blocking unsafe, adult, and malicious websites based on the policy your MSP configured with you. It also handles CIPA compliance logging required for E-Rate funding.
• Shield Sentinel — Monitors student Gmail, Drive, and Chat in your school's Google Workspace for safety concerns like self-harm, bullying, grooming, and violence. When the AI finds something serious, it creates an alert with a case file and routes it to counselors, administrators, and (when appropriate) consented parents.

This guide covers what you need to do day to day: triage alerts, manage students, keep parent records current, and run the reports you need for compliance and leadership.

Key Features

• Unified alert feed — Every safety signal from Gmail, Drive, and Chat lands in one inbox with severity tier, concern category, and AI-assembled context.
• AI case files on serious alerts — Each high-severity alert includes a plain-language summary, timeline of related signals, risk factors, counselor guidance, conversation starters, and recommended next steps. No raw student message content appears in the case file.
• Four-tier alert severity — Tier 0 filters out noise; tier 1 is for monitoring; tier 2 alerts counselors; tier 3 is immediate and reaches administrators plus consented parents.
• Comment threads with @THEO — Every alert has a conversation thread where staff can coordinate. Mention @THEO for a second opinion, suggested language for a parent conversation, or a student history summary.
• Student timeline view — Click a student to see every signal and alert in chronological order, so you can spot trends.
• At-risk student dashboard — Shows your top 10 students by risk score (auto-calculated from signal severity and frequency).
• Parent consent tracking — Parent accounts cannot be included in an alert's recipients until you've verified consent is on file. This is a legal requirement under COPPA and FERPA, and Shield enforces it.
• Custom school branding — Your school's name and logo appear on the parent login page, powered by your unique school URL slug.
• CIPA audit and reports — Downloadable reports of every block in a CIPA-relevant category over any 400-day window, suitable for E-Rate filing.
• Chrome extension — Extends DNS filtering to student devices off-campus, including a safe-search rewrite.
• Safe Search, not a per-video YouTube review — Shield does not offer a per-video YouTube review; that portion is retired. What a student can watch is governed by YouTube Restricted Mode and domain-level DNS rules.

How To: Sign In and Navigate the Portal

1. Open the magic-link email your MSP sent when they invited you, or go directly to your school's portal URL (app.theonestack.com/portal/shield/<your-slug>).
2. Enter your email. Shield emails a one-time sign-in link. Click it to land in the portal.
3. The left nav shows Alerts, Students, Parents, Reports, Settings, and (for school admins) DNS Policy.

Your role determines what you can see and do:

• School Admin — Everything: alerts, students, parents, DNS policy, settings, reports.
• Counselor — Alerts, students, parents, reports. No DNS policy.
• Staff — Read-only view of alerts, student timelines, and reports. Can comment but cannot resolve.

If something is missing, talk to your school admin or your MSP about adjusting your role.

How To: Review and Respond to Alerts

Alerts are ordered by severity and recency. New alerts have a new status badge; once someone takes ownership they become acknowledged; once the situation is handled they become resolved.

Triage an alert:

1. Click the alert in the inbox.
2. Read the case file at the top. It's organized into summary, timeline snippets, risk factors, counselor guidance, conversation starters, and recommended actions. This is AI-assembled by THEO for severity-3 and severity-4 signals, designed to give you what you need without showing you the original student messages.
3. Scroll down to the comment thread. Read any prior comments from staff, parents, or THEO.
4. If you are the right person to own this, click Acknowledge. Status changes from new to acknowledged.

Work the alert:

1. Post comments in the thread to coordinate with other staff. Mark a comment as internal to hide it from parents.
2. Mention @THEO if you want AI help — see the dedicated section below.
3. Reach out to the student, family, or other staff per your school's intervention protocol. Shield gives you context; it does not replace your judgment.

Close the alert:

• Resolve — The situation has been handled. Add resolution notes (what happened, what was done). Status changes to resolved.
• False Positive — The AI got it wrong (classroom assignment about a difficult topic, song lyric quoted in an email, sibling joking). Mark it as false positive with a short reason. Shield sends this back to the training pipeline so the AI learns from it.

What the tiers mean:

The tier is a composite of severity (1-4 from the AI analyzer) and the analyzer's recommended action. Severity 4 almost always produces a tier 3 alert; severity 1-2 rarely do.

How To: Use @THEO in a Comment Thread

THEO is the platform's AI assistant, embedded in the alert thread so you can pull it in when you need a second set of eyes.

To use THEO, type @THEO in your comment and check the mention box. When you post, Shield sends THEO the alert context, the last 20 comments in the thread, and metadata on the student's prior 10 alerts — never the raw student messages or their email address. THEO replies in the thread and its response is visible to everyone authorized on that alert.

Common ways to use @THEO:

• "@THEO what are the warning signs I should watch for with this student?"
• "@THEO help me draft language to reach out to this parent."
• "@THEO summarize this student's prior alerts."
• "@THEO what's a good conversation opener for a counselor check-in on this topic?"

THEO adjusts its tone based on who triggered the mention. If a parent @THEOs it, the tone is warm and non-clinical. If staff mentions it, the tone is professional and trauma-informed.

THEO's replies are part of the audit record and cannot be deleted.

How To: Manage Students

The Students tab shows every student Sentinel has observed in your school's Google Workspace.

• Display name — Shows the first name from the Google directory, or a sanitized "Student 042"-style placeholder if the directory lookup didn't return one.
• Risk score — 0 to 100, auto-calculated from signal severity and recency. Anything at 40 or above shows on the at-risk dashboard.
• Last signal — Timestamp of the most recent detected signal.

Click a student to see:

• The full event timeline (every signal and alert in chronological order)
• Related parent links

Student opt-out (FERPA / 18-plus):

If a parent formally requests a student be removed from monitoring, or a student turns 18 and requests it themselves, open the student's record and submit an opt-out. Enter who is requesting it and an optional reason. From that point on, Sentinel will not generate signals for that student. The record remains for historical reference but new activity stops being analyzed.

Student emails are never visible in plaintext anywhere in the portal — the whole platform keys on SHA-256 hashes. You see display names; the hashes sit underneath.

How To: Manage Parent Accounts

The Parents tab is where you invite parents, verify consent, and link them to their children.

Invite a single parent:

1. Click Add Parent.
2. Enter email, name, phone (optional), and relationship (mother, father, guardian, legal custodian).
3. Paste the student's school email address to link them. Shield validates the email against your student roster — if the student isn't in your Google Workspace, the link won't stick.
4. Set the parent's preferred notification channel: email on/off, SMS on/off. These are recorded preferences — no email or SMS alert is sent today.
5. Click Invite. Shield sends a magic-link email; the parent clicks it to sign in.

Bulk import parents from CSV:

1. Click Import. Upload a file with columns for parent email, parent name, optional phone, student email or student name, and relationship. Up to 5000 rows.
2. Shield previews every row. Rows with a matching student email show "exact." Rows with only a name get fuzzy name-match suggestions (up to three per row). Rows with no match show "none."
3. Review the preview. For each row you can accept the auto-match, pick a different candidate, or skip.
4. Click Confirm. Shield creates the parent records, links them to verified students, and fires invite emails.

Import sessions are deleted after seven days if unconfirmed, or thirty days after confirmation. No PII persists longer than needed.

Verify parent consent:

Parents are silently excluded from an alert's recipients until someone marks their record as consent-verified. This is the COPPA/FERPA gate and it is enforced in code.

1. Confirm the school has a signed consent form on file (your school's legal-required documentation).
2. Open the parent's record.
3. Toggle Consent Verified to on. Save.

From that point forward, the parent is included as a recipient for alerts at whatever tier your school has configured. The alert appears in the Sentinel alert inbox the counselor dashboard reads and, for the parent, in the parent portal; no email, SMS, push or page is sent.

How To: Configure Your School Settings

(School admins only.)

1. Open the Settings tab. You can change your school name, logo URL (upload to your own storage first and paste the HTTPS link), and notification preferences.
2. The school URL slug is locked after initial activation — if you need to change it, contact your MSP. Changing the slug would break every parent's magic-link flow.
3. Configure Sentinel routing:
   • Which tier triggers parent notification? The system default is 3, so parents are included for critical alerts only. Set to 2 to include parents for counselor-level concerns as well; set to 1 for parents-on-every-real-signal.
   • Which email addresses should receive tier-2 (counselor) alerts?
   • Which email addresses should receive tier-3 (admin) alerts?
   • Is the weekly parent digest on, and which day is it set for (default Friday)? ⚠️ The digest is defined and never invoked: the generator exists but nothing calls it, so no digest is produced for any client today — it is not emailed to parents.
4. Configure DNS policy: CIPA mode, SafeSearch, YouTube restriction, blocked categories, allowed categories. These are set by your MSP during activation and generally stay as-is.

How To: Run Reports

The Reports tab has several report types:

• Sentinel dashboard — Active alerts broken down by tier, top 10 at-risk students, 30-day trend of signals and escalations.
• CIPA compliance report — Every block in a CIPA-relevant category (obscene, harmful to minors, child safety) over a date range up to 400 days. The portal downloads the report as a printable HTML document. Shield serves the report as JSON and does not generate or serve a PDF — a PDF is only what your browser's print-to-PDF ("Save as PDF" in the print dialog) makes from that document.
• CIPA audit log — Raw paginated log of every CIPA-category block with domain, device, and timestamp.
• DNS summary — Total queries, top 20 blocked categories, top 20 blocked domains, and a daily timeline over the time range you pick.
• Verdict detail — Look up any specific domain to see which tier flagged it, the source, the reason, and any crawl evidence.
• Billing usage — (If your MSP shares this) Device count, student count, tier, and monthly total.

Frequently Asked Questions

Can Shield see what students are doing on their personal phones off our network? Only if the Chrome extension is installed on their school-issued devices. Shield DNS filtering only applies to devices that use Shield's DNS resolvers. Sentinel only applies to student accounts inside your school's Google Workspace — it does not monitor personal Gmail, personal Drive, or anything outside the Workspace scope your MSP authorized.

Can counselors see other counselors' alerts? Yes. All school-role users in your school see the same alert inbox. Only the comment thread's internal-only notes are hidden from parents; staff see everything each other writes.

What happens when a parent replies to an alert comment? Shield appends their comment to the thread. Counselors and admins see it in the portal, along with a notification. Parents only see non-internal comments, and only for alerts linked to their own students.

Does the student know they're being monitored? Schools are expected to disclose monitoring in their acceptable-use policy, and parents sign consent forms. Shield does not send anything to the student account or tip its hand. What you tell students and how is your school's call.

Does the AI ever see student names? THEO only receives an opaque identifier like S3f9a2b — the first six hex characters of the student's hash. Never the email, never the display name, never the full hash. The Sentinel analyzer models receive the content body for analysis but do not persist it; only hashes and metadata reach the database.

What if the AI got it wrong? Mark the alert as False Positive. Shield sends that feedback into the training pipeline so the model improves over time.

Can a parent see another student's alerts? No. Every parent-facing endpoint verifies the parent-to-student link before returning data. Even if a parent somehow obtains an alert ID for another student, the server refuses to return it.

What's the difference between acknowledging and resolving? Acknowledging means "I'm working on this." Resolving means "I've handled this." The workflow is: new → acknowledged → resolved. You can skip straight to resolved if appropriate, but acknowledging first lets other staff know someone is on it.

Can we delete an alert? No. Alerts are part of the compliance audit trail. You can mark them False Positive or Resolved, but not delete them.

Can I delete a comment I posted? Your own comments, within five minutes of posting, yes. After that, only school admins (or the MSP) can moderate comments. THEO's replies are never deletable — they're audit-relevant.

Will Shield work for us if we're not on Google Workspace? Shield DNS works regardless of your email/productivity platform. Sentinel currently only supports Google Workspace; Microsoft 365 is on the roadmap.

Troubleshooting

I can't see any alerts even though I know Sentinel is connected. Check with your school admin — you may need the shield.view_alerts permission flag added to your role.

I can't acknowledge or resolve alerts even though I'm a counselor. Your role needs the shield.resolve_alerts flag. Talk to your school admin or MSP.

A parent is telling us they never got an alert email. Three things to check:

1. Is their record marked consent-verified? Until it is, they are silently excluded from every notification. This is the most common cause.
2. Is your school's parent-notification tier threshold set higher than the alert's tier? If the threshold is 3 and the alert was tier 2, parents won't be notified.
3. Do they have email notifications turned on in their parent record?

The magic-link email isn't arriving for a parent or staff member. Check spam folders first. If still missing, have your MSP re-send the invite from the parent or user record.

An alert references content that the student says they never sent. Sentinel analyzes content from your school's Google Workspace, so the content came from the student's school account. Possible explanations: shared device, account compromise, another user sending from the account, or a rare AI misclassification (mark it False Positive).

The CIPA report is empty even though I know things have been blocked. CIPA logging only fires when CIPA mode is enabled for the client. Check your DNS policy settings and confirm CIPA mode is on. Existing blocks from before CIPA mode was enabled won't be in the report.

I see a student in the roster I don't recognize. Sentinel discovers students from Gmail/Drive/Chat activity. If someone sent or received a message in your school's Workspace, they appear here. Check with IT about any unfamiliar accounts.

@THEO replied with "THEO is temporarily unavailable." Something failed on the way to THEO (timeout, service issue). Try again in a minute. The fallback message keeps the thread moving even when THEO is offline.

I want to change our school's name or logo. Settings tab. The slug is locked, but name and logo URL are editable by school admins.