{
  "standard": "HECVAT",
  "title": "Novak LMS\u2122 HECVAT v3.04 (Higher Education Community Vendor Assessment Toolkit) Response",
  "platform": "Novak LMS\u2122",
  "url": "https://novak-lms.onrender.com/compliance",
  "generated_at": "2026-10-27T08:05:01Z",
  "contact": "novakornothing@gmail.com",
  "audit_verification": {
    "verified": true,
    "events_count": 15
  },
  "controls_count": 8,
  "controls": [
    {
      "domain": "GEN \u2014 Institution & Vendor Governance",
      "id": "HECVAT-GEN-01",
      "question": "Does the solution support higher-education & government training deployments with documented security, privacy, and accessibility policies?",
      "response": "Yes \u2014 Compliant",
      "evidence": "Novak LMS\u2122 provides public and admin documentation (/compliance, /privacy, /specs), VPAT 2.5 AA conformance, FERPA-aligned data governance, and zero third-party ad/tracker scripts."
    },
    {
      "domain": "DATA \u2014 FERPA & Student Data Privacy",
      "id": "HECVAT-DATA-01",
      "question": "Is institutional and student PII/education record data isolated, never sold, and exportable/deletable by the student or institution?",
      "response": "Yes \u2014 Compliant",
      "evidence": "Strict tenant/institution scoping (institution_id); zero data brokerage or advertising; self-service student record download (JSON) and erasure/correction workflow at /my-data."
    },
    {
      "domain": "PRIV \u2014 Biometric & Webcam Privacy (Helix)",
      "id": "HECVAT-PRIV-01",
      "question": "Does the platform transmit or store student webcam video, images, or raw biometric recordings on external servers?",
      "response": "No Video Ever Transmitted \u2014 100% On-Device",
      "evidence": "Helix 478-landmark MediaPipe FaceMesh gaze tracking is strictly opt-in per session, runs 100% locally in the browser via WebAssembly/WebGL, and sends only aggregate numerical dwell summaries. Saying no never affects grades."
    },
    {
      "domain": "AI \u2014 Generative AI & Grounded Tutor Controls",
      "id": "HECVAT-AI-01",
      "question": "Are AI tutoring features grounded in course-approved curriculum with instructor kill-switches and zero training on student PII?",
      "response": "Yes \u2014 Compliant",
      "evidence": "The Course Tutor retrieves strictly from vetted course lessons, 4-rung ladders, lab guides, and glossaries with explicit source citations, refuses to hand out graded test answers, and can be toggled on/off per section by the instructor."
    },
    {
      "domain": "IAM \u2014 SSO, SAML 2.0, OIDC & LTI 1.3 Advantage",
      "id": "HECVAT-IAM-01",
      "question": "Does the platform integrate with campus Identity Providers (SAML 2.0 / OIDC) and LMS platforms via LTI 1.3 Advantage?",
      "response": "Yes \u2014 Compliant",
      "evidence": "Built-in LTI 1.3 Advantage OIDC login, JWKS keyset (/lti/jwks.json), Deep Linking, and Assignment & Grade Services (AGS) for Canvas, Blackboard, Moodle, and D2L Brightspace, plus SAML 2.0 / OIDC SSO."
    },
    {
      "domain": "CRYPTO \u2014 Encryption in Transit & At Rest",
      "id": "HECVAT-CRP-01",
      "question": "Is all traffic encrypted via TLS 1.2/1.3 with HSTS, and are credentials hashed with modern memory-hard/salted KDFs?",
      "response": "Yes \u2014 Compliant",
      "evidence": "Enforced HTTPS with HSTS (max-age=31536000; includeSubDomains), TLS 1.3 edge termination, encrypted database storage at rest, and Werkzeug scrypt/PBKDF2 salted password hashes."
    },
    {
      "domain": "AUDIT \u2014 Tamper-Evident Audit Logging",
      "id": "HECVAT-AUD-01",
      "question": "Are administrative actions, grade modifications, logins, and data exports logged in a tamper-evident audit trail?",
      "response": "Yes \u2014 Compliant",
      "evidence": "Every sensitive event is recorded in AuditLog with a cryptographic SHA-256 hash chain (prev_hash -> entry_hash) verified continuously at /admin/audit and /admin/compliance."
    },
    {
      "domain": "BCDR \u2014 Availability, Backups & Disaster Recovery",
      "id": "HECVAT-BCDR-01",
      "question": "Does the platform maintain health checks, database backups, and zero-VDI browser lab resilience?",
      "response": "Yes \u2014 Compliant",
      "evidence": "Continuous /healthz telemetry, 1-click encrypted database snapshot exports (/admin/backup), and 90 browser-native labs (including WebAssembly Linux VMs) that eliminate remote VDI server outages."
    }
  ]
}