Security Architecture, Zero-Video Privacy, Section 508 (VPAT® 2.5) & SCORM/xAPI Trust Center
Verifiable technical security safeguards: 100% client-side RAM gaze processing (zero video transmitted), browser-sandboxed WebAssembly lab isolation, TLS 1.3 / RBAC / SHA-256 tamper-evident audit logging, WCAG 2.1/2.2 AA & Revised Section 508 accessibility, and native SCORM 1.2 / 2004 & ADL xAPI (cmi5) interoperability.
1. VPAT® 2.5 — WCAG 2.1/2.2 Level A / AA & Revised Section 508 Accessibility Conformance Report (ACR)
Product Evaluated: Novak LMS™ Adaptive Learning, Lab & Certification Readiness Platform · Evaluation Methods: Automated axe-core WCAG 2.1/2.2 Level AA suite, keyboard-only navigation audits, screen-reader live-region verification, and color-contrast validation across Light Mode and Dark Mode.
| Criterion | Standard / Requirement | Level | Conformance Level | Remarks & Technical Implementation |
|---|---|---|---|---|
1.1.1 |
Non-text Content | A | ✓ Supports | All 115 inline lesson SVG architecture blueprints, 10 multi-layer SVG diagrams, and 36 PBQ Workbench topologies include descriptive role="img", aria-label, title/caption text, and accompanying HTML technical specification tables. |
1.2.1–1.2.5 |
Time-based Media & Audio Narration | A / AA | ✓ Supports | Built-in neural and local browser text-to-speech narration highlights synchronized words (.tts-word) directly against the complete written lesson text transcript. |
1.3.1 |
Info and Relationships | A | ✓ Supports | Semantic HTML5 landmarks (<header>, <nav>, <main>, <aside>, <section>, <footer>), <fieldset>/<legend> question stems, explicit <label for="..."> associations, and scope="col"/scope="row" table headers. |
1.3.2 |
Meaningful Sequence | A | ✓ Supports | DOM reading order matches visual layout across lessons, 4-rung adaptive ladders (R0–R4), Split-Pane PBQ Workbenches, and mobile responsive stacked tables. |
1.3.3 |
Sensory Characteristics | A | ✓ Supports | Instructions and status indicators never rely solely on shape, size, or visual location; all PBQ nodes, mastery cells, and section steppers include explicit text badges and ARIA labels. |
1.3.4–1.3.5 |
Orientation & Identify Input Purpose | AA | ✓ Supports | Supports portrait and landscape orientations from 320px phones to widescreen desktops; authentication and onboarding forms provide standard autocomplete attributes. |
1.4.1 |
Use of Color | A | ✓ Supports | Mastery heatmaps, exam review grids, and PBQ configuration badges pair color with text symbols (✓, ●, ○, S flag) and screen-reader status strings. |
1.4.3 |
Contrast (Minimum — 4.5:1) | AA | ✓ Supports | Verified via automated axe-core WCAG 2.1 AA sweeps across both Light Mode (#0f172a ink on #ffffff/#f8fafc surfaces) and Dark Mode (#f8fafc ink on #070d19/#0f172a surfaces), including search inputs and AI Tutor textareas. |
1.4.4 & 1.4.10 |
Resize Text (200%) & Reflow (320 CSS px) | AA | ✓ Supports | Responsive fluid typography and responsive table wrappers (.ui-table-wrap, table.table-stack) reflow cleanly at 200% zoom and 320px viewport width without horizontal page scrolling. |
1.4.11–1.4.13 |
Non-text Contrast, Text Spacing & Hover/Focus Content | AA | ✓ Supports | UI controls, form borders, SVG diagram nodes, and focus rings maintain >= 3:1 contrast; Escape dismisses drawers, modals, and live search popovers. |
2.1.1 & 2.1.2 |
Keyboard & No Keyboard Trap | A | ✓ Supports | 100% keyboard operable across lessons, 4-rung ladders, Exam-Sim shortcuts (←/→, 1–6, F, W), Speed-Drill flashcards, Split-Pane PBQ SVG nodes (Tab/Enter/Space), and CLI consoles. |
2.2.1 & 2.2.2 |
Timing Adjustable (ADA Exam Accommodations) | A | ✓ Supports | Instructors and administrators can grant per-student ADA time accommodations (1.25x, 1.5x, 2.0x) on Knowledge Tests and Exam-Day Simulator sittings, plus practice-mode server-side pause. |
2.3.1 |
Three Flashes or Below Threshold | A | ✓ Supports | Zero flashing content; strictly honors @media (prefers-reduced-motion: reduce) across all CSS transitions and JavaScript animations. |
2.4.1–2.4.7 |
Navigable (Skip Links, Focus Order, Headings, Focus Visible) | A / AA | ✓ Supports | Every page begins with a visible-on-focus "Skip to main content" link; high-contrast 3px outline focus rings; persistent 1-click Curriculum Sidebar and Section Stepper pills. |
3.1.1–3.3.4 |
Readable, Predictable & Input Assistance | A / AA | ✓ Supports | Explicit lang="en" attribute; inline accessible form validation with aria-invalid and aria-describedby error messages; non-destructive confirmation guards. |
4.1.1–4.1.3 |
Compatible & Status Messages (ARIA Live Regions) | A / AA | ✓ Supports | Dynamic updates in ladder checks, Exam-Sim timers/autosave, Speed-Drill feedback, PBQ CLI/Inspector outputs, and AI Tutor responses announce via role="status" and aria-live="polite". |
Section 508 Ch. 3, 5 & 6 |
Functional Performance Criteria, Web Software & Support Docs | Revised 508 | ✓ Supports | Full support for users without vision, with limited vision, without perception of color, without hearing, and with limited manipulation. Opt-in Helix webcam gaze tracking is 100% optional and never impacts grades. |
2. Zero-Video Client-Side Privacy, Browser Lab Sandbox Isolation & FERPA/GDPR Data Governance
Factual architecture controls verifying how Novak LMS™ isolates student lab environments and processes webcam attention signals 100% locally in volatile browser RAM.
| Control ID | Architecture Domain | Technical Question | Status | Implemented Platform Evidence |
|---|---|---|---|---|
PRIV-RAM-01 |
PRIV — Zero-Video Client-Side Biometric Privacy (Helix™) | Does the platform transmit or store student webcam video, images, or raw biometric recordings on external servers? | ✓ No Video Ever Transmitted — 100% Client-Side RAM | Helix™ 478-landmark MediaPipe FaceMesh gaze tracking is strictly opt-in per session, executes 100% locally in volatile browser RAM via WebAssembly, and transmits only aggregate numerical dwell summaries. Saying no never affects grades. |
PRIV-DATA-02 |
DATA — FERPA & GDPR Student Record Ownership | Is institutional and student education record data isolated, never sold, and exportable/deletable by the student? | ✓ Yes — Active & Verified | Strict institutional scoping (institution_id); zero third-party ad trackers or data brokers; self-service student record download (JSON) and erasure/correction workflow at /my-data. |
SEC-LAB-03 |
SANDBOX — Browser-Sandboxed Lab Isolation | How are the 105 hands-on Linux, Windows, and Cisco labs isolated from the host machine and external network? | ✓ 100% Browser-Sandboxed Execution | All 105 hands-on labs (including 24 WebAssembly v86 Linux VMs and 8 Ubuntu GNOME GUI + Bash workbenches) execute inside isolated client-side browser sandboxes with zero external network attack surface. |
PRIV-AI-04 |
AI — Grounded Course Tutor Controls | Are AI tutoring features grounded in course curriculum with instructor controls and zero training on student PII? | ✓ Yes — Active & Verified | The Course Tutor retrieves strictly from course lessons, 5-path ladders, lab guides, and glossaries with source citations, refuses to hand out graded test answers, and can be toggled on/off per section by the instructor. |
3. Transport Encryption, Authentication, RBAC & SHA-256 Tamper-Evident Audit Architecture
Implemented application security safeguards, session hardening, password hashing, and cryptographic audit logging verified in the codebase.
| Control ID | Category | Safeguard | Status | Technical Implementation & Verification |
|---|---|---|---|---|
SEC-TLS-01 |
Transport & Session Encryption | TLS 1.3 / HTTPS & Hardened Session Cookies | ✓ Active & Verified | Enforced HTTPS with HSTS (max-age=31536000; includeSubDomains), TLS 1.3 edge termination, and HttpOnly, SameSite=Lax, Secure session cookies. |
SEC-AUTH-02 |
Authentication & Access Control | PBKDF2/scrypt Password Hashing, RBAC & LTI 1.3 / SSO | ✓ Active & Verified | Werkzeug salted scrypt/PBKDF2 password hashing, strict role-based access control (@role_required for Student, Instructor, Admin), SAML 2.0 / OIDC SSO, and RSA-2048 JWKS signed LTI 1.3 Advantage handshakes. |
SEC-CSRF-03 |
Request & Input Integrity | CSRF Protection, Parameterized Queries & CSP Headers | ✓ Active & Verified | Synchronizer CSRF tokens enforced on all state-changing POST/PUT/DELETE requests, SQLAlchemy parameterized queries, 100% self-hosted vendor assets (zero external CDN scripts), and strict X-Content-Type-Options: nosniff. |
SEC-AUDIT-04 |
Tamper-Evident Audit Logging | SHA-256 Cryptographic Hash-Chained Audit Trail | ✓ Active & Verified | Append-only SHA-256 hash-chained AuditEvent log (prev_hash -> entry_hash) for logins, gradebook changes, and data exports, verified continuously at /admin/audit and /security. |
SEC-OSS-05 |
Open-Source Toolchain Governance | 100% Permissive MIT / Apache-2.0 / BSD-2-Clause Runtime | ✓ Active & Verified | All client and server dependencies (v86 BSD-2-Clause, MediaPipe Apache-2.0, Bootstrap/Flask/SQLAlchemy MIT/BSD) are verified permissive with zero viral copyleft in the host runtime (/compliance/oss-licenses). |
4. DoD Navy ILE, SCORM 1.2 / 2004 (4th Ed), ADL xAPI (IEEE 9274.1.1 / cmi5) & LTI 1.3 Interoperability Bridge
Engineered for zero-friction deployment across DoD / U.S. Navy Integrated Learning Environment (ILE), Ready Relevant Learning (RRL), JKO, Canvas, Blackboard Learn Ultra, Moodle, D2L Brightspace, and enterprise LMS platforms. Download ready-to-import SCORM 1.2 or SCORM 2004 (4th Edition) dispatch packages with real-time NOVAK_LMS_SCORM_EVENT score/completion synchronization and official ADL xAPI 1.0.3 (`IEEE 9274.1.1-2023` / `cmi5`) Learning Record Store (LRS) telemetry.
CIN: A-150-2201
IT Support (220-1201 / 220-1202)
13 chapters · 58 visual lessons · Ubuntu GNOME GUI & Windows 11 workbenches.
CIN: A-150-0009
Network Operations (N10-009)
7 chapters · 33 visual lessons · Cisco IOS Switch/Router CLI & 24 Linux VMs.
CIN: A-150-0071
Client Systems (FC0-U71)
6 chapters · 24 visual lessons · Windows 11 GUI & Ubuntu GNOME desktop labs.
5. Zero-Server Biometric Privacy, FERPA & Self-Service Student Data Portability (/my-data)
✓ 100% Client-Side RAM Gaze Processing · 0 Video TransmittedZero Biometric Video Transmission
Helix™ attention telemetry executes 100% locally inside the learner's browser WebAssembly sandbox (`@mediapipe/tasks-vision` + `OneEuro1D`). Raw webcam frames never leave device RAM and are never uploaded, recorded, or stored on any server.
Self-Service Data Portability & Erasure
Every learner and administrator has 1-click access to `/my-data` for machine-readable JSON educational record portability and cryptographic right-to-erasure / consent revocation logged in our SHA-256 hash chain.
100% Self-Hosted Assets & Permissive OSS Stack
Zero third-party ad trackers, zero external CDN font/script leaks, and 100% permissive MIT / Apache-2.0 / BSD-2-Clause client libraries (/compliance/oss-licenses).
Need a Technical Architecture Briefing or Institutional Security Packet?
Download the JSON/CSV/Markdown security & accessibility bundles above, schedule a 25-minute technical consult, or launch a 30-Day / 30-Student Free Institutional Pilot Bundle immediately.