Institutional Trust, Accessibility & Security Architecture
VPAT® 2.5, SOC 2 & HECVAT Compliance Center
Verifiable accessibility conformance (WCAG 2.1 Level AA & Revised Section 508), Higher Education Community Vendor Assessment Toolkit (HECVAT v3.04), and AICPA SOC 2 Trust Services Criteria (CC1–CC9) control matrix.
WCAG 2.1 AA / Section 508
VPAT 2.5
100% Level A & AA Criteria Supported · ADA 1.25×–2.0× Timers
Higher-Ed Assessment
HECVAT v3.04
FERPA-Aligned · LTI 1.3 Advantage · SAML 2.0 / OIDC SSO
Trust Services Criteria
SOC 2 TSC
CC1–CC9, Availability, Confidentiality & Privacy Controls
SHA-256 Audit Hash Chain
VERIFIED
15 Tamper-Evident Audit Events · 0 Video Transmitted
1. VPAT® 2.5 — WCAG 2.1 Level A / AA & Revised Section 508 Accessibility Conformance Report (ACR)
Product Evaluated: Novak LMS™ Adaptive Learning, Lab & Certification Readiness Platform · Evaluation Methods: Automated axe-core WCAG 2.1 Level AA suite, keyboard-only navigation audits, screen-reader live-region verification, and color-contrast validation across Light Mode and Dark Mode.
| Criterion | Standard / Requirement | Level | Conformance Level | Remarks & Technical Implementation |
|---|---|---|---|---|
1.1.1 |
Non-text Content | A | ✓ Supports | All 115 inline lesson SVG architecture blueprints, 10 multi-layer SVG diagrams, and 36 PBQ Workbench topologies include descriptive role="img", aria-label, title/caption text, and accompanying HTML technical specification tables. |
1.2.1–1.2.5 |
Time-based Media & Audio Narration | A / AA | ✓ Supports | Built-in neural and local browser text-to-speech narration highlights synchronized words (.tts-word) directly against the complete written lesson text transcript. |
1.3.1 |
Info and Relationships | A | ✓ Supports | Semantic HTML5 landmarks (<header>, <nav>, <main>, <aside>, <section>, <footer>), <fieldset>/<legend> question stems, explicit <label for="..."> associations, and scope="col"/scope="row" table headers. |
1.3.2 |
Meaningful Sequence | A | ✓ Supports | DOM reading order matches visual layout across lessons, 4-rung adaptive ladders (R0–R4), Split-Pane PBQ Workbenches, and mobile responsive stacked tables. |
1.3.3 |
Sensory Characteristics | A | ✓ Supports | Instructions and status indicators never rely solely on shape, size, or visual location; all PBQ nodes, mastery cells, and section steppers include explicit text badges and ARIA labels. |
1.3.4–1.3.5 |
Orientation & Identify Input Purpose | AA | ✓ Supports | Supports portrait and landscape orientations from 320px phones to widescreen desktops; authentication and onboarding forms provide standard autocomplete attributes. |
1.4.1 |
Use of Color | A | ✓ Supports | Mastery heatmaps, exam review grids, and PBQ configuration badges pair color with text symbols (✓, ●, ○, S flag) and screen-reader status strings. |
1.4.3 |
Contrast (Minimum — 4.5:1) | AA | ✓ Supports | Verified via automated axe-core WCAG 2.1 AA sweeps across both Light Mode (#0f172a ink on #ffffff/#f8fafc surfaces) and Dark Mode (#f8fafc ink on #070d19/#0f172a surfaces), including search inputs and AI Tutor textareas. |
1.4.4 & 1.4.10 |
Resize Text (200%) & Reflow (320 CSS px) | AA | ✓ Supports | Responsive fluid typography and responsive table wrappers (.ui-table-wrap, table.table-stack) reflow cleanly at 200% zoom and 320px viewport width without horizontal page scrolling. |
1.4.11–1.4.13 |
Non-text Contrast, Text Spacing & Hover/Focus Content | AA | ✓ Supports | UI controls, form borders, SVG diagram nodes, and focus rings maintain >= 3:1 contrast; Escape dismisses drawers, modals, and live search popovers. |
2.1.1 & 2.1.2 |
Keyboard & No Keyboard Trap | A | ✓ Supports | 100% keyboard operable across lessons, 4-rung ladders, Exam-Sim shortcuts (←/→, 1–6, F, W), Speed-Drill flashcards, Split-Pane PBQ SVG nodes (Tab/Enter/Space), and CLI consoles. |
2.2.1 & 2.2.2 |
Timing Adjustable (ADA Exam Accommodations) | A | ✓ Supports | Instructors and administrators can grant per-student ADA time accommodations (1.25x, 1.5x, 2.0x) on Knowledge Tests and Exam-Day Simulator sittings, plus practice-mode server-side pause. |
2.3.1 |
Three Flashes or Below Threshold | A | ✓ Supports | Zero flashing content; strictly honors @media (prefers-reduced-motion: reduce) across all CSS transitions and JavaScript animations. |
2.4.1–2.4.7 |
Navigable (Skip Links, Focus Order, Headings, Focus Visible) | A / AA | ✓ Supports | Every page begins with a visible-on-focus "Skip to main content" link; high-contrast 3px outline focus rings; persistent 1-click Curriculum Sidebar and Section Stepper pills. |
3.1.1–3.3.4 |
Readable, Predictable & Input Assistance | A / AA | ✓ Supports | Explicit lang="en" attribute; inline accessible form validation with aria-invalid and aria-describedby error messages; non-destructive confirmation guards. |
4.1.1–4.1.3 |
Compatible & Status Messages (ARIA Live Regions) | A / AA | ✓ Supports | Dynamic updates in ladder checks, Exam-Sim timers/autosave, Speed-Drill feedback, PBQ CLI/Inspector outputs, and AI Tutor responses announce via role="status" and aria-live="polite". |
Section 508 Ch. 3, 5 & 6 |
Functional Performance Criteria, Web Software & Support Docs | Revised 508 | ✓ Supports | Full support for users without vision, with limited vision, without perception of color, without hearing, and with limited manipulation. Opt-in Helix webcam gaze tracking is 100% optional and never impacts grades. |
2. HECVAT v3.04 — Higher Education Community Vendor Assessment Toolkit (Full & Lite)
Designed for university CIOs, CISO security review boards, community college procurement teams, and government training commands evaluating cloud learning platforms.
| HECVAT ID | Assessment Domain | Control Question | Vendor Response | Verifiable Platform Evidence |
|---|---|---|---|---|
HECVAT-GEN-01 |
GEN — Institution & Vendor Governance | Does the solution support higher-education & government training deployments with documented security, privacy, and accessibility policies? | ✓ Yes — Compliant | Novak LMS™ provides public and admin documentation (/compliance, /privacy, /specs), VPAT 2.5 AA conformance, FERPA-aligned data governance, and zero third-party ad/tracker scripts. |
HECVAT-DATA-01 |
DATA — FERPA & Student Data Privacy | Is institutional and student PII/education record data isolated, never sold, and exportable/deletable by the student or institution? | ✓ Yes — Compliant | Strict tenant/institution scoping (institution_id); zero data brokerage or advertising; self-service student record download (JSON) and erasure/correction workflow at /my-data. |
HECVAT-PRIV-01 |
PRIV — Biometric & Webcam Privacy (Helix) | Does the platform transmit or store student webcam video, images, or raw biometric recordings on external servers? | ✓ No Video Ever Transmitted — 100% On-Device | Helix 478-landmark MediaPipe FaceMesh gaze tracking is strictly opt-in per session, runs 100% locally in the browser via WebAssembly/WebGL, and sends only aggregate numerical dwell summaries. Saying no never affects grades. |
HECVAT-AI-01 |
AI — Generative AI & Grounded Tutor Controls | Are AI tutoring features grounded in course-approved curriculum with instructor kill-switches and zero training on student PII? | ✓ Yes — Compliant | The Course Tutor retrieves strictly from vetted course lessons, 4-rung ladders, lab guides, and glossaries with explicit source citations, refuses to hand out graded test answers, and can be toggled on/off per section by the instructor. |
HECVAT-IAM-01 |
IAM — SSO, SAML 2.0, OIDC & LTI 1.3 Advantage | Does the platform integrate with campus Identity Providers (SAML 2.0 / OIDC) and LMS platforms via LTI 1.3 Advantage? | ✓ Yes — Compliant | Built-in LTI 1.3 Advantage OIDC login, JWKS keyset (/lti/jwks.json), Deep Linking, and Assignment & Grade Services (AGS) for Canvas, Blackboard, Moodle, and D2L Brightspace, plus SAML 2.0 / OIDC SSO. |
HECVAT-CRP-01 |
CRYPTO — Encryption in Transit & At Rest | Is all traffic encrypted via TLS 1.2/1.3 with HSTS, and are credentials hashed with modern memory-hard/salted KDFs? | ✓ Yes — Compliant | Enforced HTTPS with HSTS (max-age=31536000; includeSubDomains), TLS 1.3 edge termination, encrypted database storage at rest, and Werkzeug scrypt/PBKDF2 salted password hashes. |
HECVAT-AUD-01 |
AUDIT — Tamper-Evident Audit Logging | Are administrative actions, grade modifications, logins, and data exports logged in a tamper-evident audit trail? | ✓ Yes — Compliant | Every sensitive event is recorded in AuditLog with a cryptographic SHA-256 hash chain (prev_hash -> entry_hash) verified continuously at /admin/audit and /admin/compliance. |
HECVAT-BCDR-01 |
BCDR — Availability, Backups & Disaster Recovery | Does the platform maintain health checks, database backups, and zero-VDI browser lab resilience? | ✓ Yes — Compliant | Continuous /healthz telemetry, 1-click encrypted database snapshot exports (/admin/backup), and 90 browser-native labs (including WebAssembly Linux VMs) that eliminate remote VDI server outages. |
3. SOC 2 Trust Services Criteria (AICPA TSC CC1–CC9, Availability, Confidentiality, Privacy)
Live mapping of AICPA Trust Services Criteria to Novak LMS™ technical safeguards, cryptographic controls, and continuous verification gates.
| TSC Criteria | Category | Control Objective | Status | Technical Implementation & Verification |
|---|---|---|---|---|
CC1.1 – CC1.5 |
Control Environment | Role-Based Governance & Institutional Ethics | ✓ Active & Verified | Strict separation of Student, Instructor, and Administrator privileges (@role_required), institutional tenant scoping, and transparent privacy disclosures. |
CC2.1 – CC2.3 |
Communication & Information | Transparent Security, Syllabus & Privacy Specifications | ✓ Active & Verified | Public machine-readable specifications (/specs, /llms.txt, /compliance), in-app privacy policy (/privacy), and explicit per-session consent dialogs for Helix telemetry. |
CC3.1 – CC3.4 |
Risk Assessment | Automated Threat Mitigation & Dependency Hygiene | ✓ Active & Verified | Zero external CDN script dependencies (100% self-hosted vendor assets), strict Content-Security-Policy (CSP), X-Frame-Options, and X-Content-Type-Options: nosniff. |
CC4.1 – CC4.2 |
Monitoring Activities | Real-Time Health, TQI & Audit Chain Verification | ✓ Active & Verified | Automated /healthz endpoint, Training Quality Indicator (TQI) packet monitoring, and live SHA-256 AuditLog hash-chain integrity verification. |
CC5.1 – CC5.3 |
Control Activities | CSRF Protection, Input Sanitization & Rate Limiting | ✓ Active & Verified | Synchronizer CSRF tokens enforced on all state-changing POST/PUT/DELETE requests (HTML forms and fetch headers), SQLAlchemy parameterized queries, and login/API rate limiting. |
CC6.1 – CC6.8 |
Logical & Physical Access Controls | Authentication, Session Hardening & LTI 1.3 / SSO | ✓ Active & Verified | HttpOnly, SameSite=Lax, and Secure session cookies; salted scrypt/PBKDF2 password hashes; SAML 2.0 / OIDC SSO; RSA-2048 JWKS signed LTI 1.3 Advantage handshakes. |
CC7.1 – CC7.5 |
System Operations & Incident Response | Tamper-Evident Logging & Operational Ticketing | ✓ Active & Verified | Append-only SHA-256 hash-chained AuditLog for all authentication, gradebook, and data-export events, paired with built-in curriculum/system ticket triage (/admin/tickets). |
CC8.1 |
Change Management | Automated 1,000+ Test CI Gate & Schema Validation | ✓ Active & Verified | Every release passes 972+ pytest integration/security/accessibility tests and 56+ Node.js unit tests, plus deterministic r0_sha curriculum stamp verification. |
CC9.1 – CC9.2 |
Risk Mitigation & Vendor Management | Zero Third-Party Subprocessor Lock-In for Labs or Gaze | ✓ Active & Verified | All 90 labs (including 24 WebAssembly Linux VMs) and 478-landmark Helix gaze tracking execute locally in the user browser—eliminating third-party cloud VM and video-proctoring subprocessors. |
A1.1 – A1.3 |
Availability | Stateless Web Workers, Brotli Asset Bundling & DB Backups | ✓ Active & Verified | Immutable content-hashed CSS/font bundles with Brotli/Gzip compression, SQLite WAL / PostgreSQL pooling, and 1-click admin database backups. |
C1.1 – C1.2 & P1–P8 |
Confidentiality & Privacy (FERPA) | Data Minimization, Self-Service Export & Right to Erasure | ✓ Active & Verified | Students control their own education record via /my-data (full JSON export and account/record deletion request) with zero behavioral advertising. |
Need a Signed Vendor Questionnaire or Custom Institutional Security Packet?
Download the JSON/CSV/Markdown compliance bundles above or launch a self-service 30-Day / 30-Student Free Institutional Pilot Bundle immediately.