# Novak LMS™ HECVAT v3.04 (Higher Education Community Vendor Assessment Toolkit) Response
- **Platform**: Novak LMS™ (`https://novak-lms.onrender.com` / `https://novakornothing.com`)
- **Generated**: 2026-10-27T08:02:24Z
- **Contact**: `novakornothing@gmail.com`

| ID | DOMAIN | QUESTION | RESPONSE | EVIDENCE |
| --- | --- | --- | --- | --- |
| HECVAT-GEN-01 | GEN — Institution & Vendor Governance | Does the solution support higher-education & government training deployments with documented security, privacy, and accessibility policies? | Yes — Compliant | Novak LMS™ provides public and admin documentation (/compliance, /privacy, /specs), VPAT 2.5 AA conformance, FERPA-aligned data governance, and zero third-party ad/tracker scripts. |
| HECVAT-DATA-01 | DATA — FERPA & Student Data Privacy | Is institutional and student PII/education record data isolated, never sold, and exportable/deletable by the student or institution? | Yes — Compliant | Strict tenant/institution scoping (institution_id); zero data brokerage or advertising; self-service student record download (JSON) and erasure/correction workflow at /my-data. |
| HECVAT-PRIV-01 | PRIV — Biometric & Webcam Privacy (Helix) | Does the platform transmit or store student webcam video, images, or raw biometric recordings on external servers? | No Video Ever Transmitted — 100% On-Device | Helix 478-landmark MediaPipe FaceMesh gaze tracking is strictly opt-in per session, runs 100% locally in the browser via WebAssembly/WebGL, and sends only aggregate numerical dwell summaries. Saying no never affects grades. |
| HECVAT-AI-01 | AI — Generative AI & Grounded Tutor Controls | Are AI tutoring features grounded in course-approved curriculum with instructor kill-switches and zero training on student PII? | Yes — Compliant | The Course Tutor retrieves strictly from vetted course lessons, 4-rung ladders, lab guides, and glossaries with explicit source citations, refuses to hand out graded test answers, and can be toggled on/off per section by the instructor. |
| HECVAT-IAM-01 | IAM — SSO, SAML 2.0, OIDC & LTI 1.3 Advantage | Does the platform integrate with campus Identity Providers (SAML 2.0 / OIDC) and LMS platforms via LTI 1.3 Advantage? | Yes — Compliant | Built-in LTI 1.3 Advantage OIDC login, JWKS keyset (/lti/jwks.json), Deep Linking, and Assignment & Grade Services (AGS) for Canvas, Blackboard, Moodle, and D2L Brightspace, plus SAML 2.0 / OIDC SSO. |
| HECVAT-CRP-01 | CRYPTO — Encryption in Transit & At Rest | Is all traffic encrypted via TLS 1.2/1.3 with HSTS, and are credentials hashed with modern memory-hard/salted KDFs? | Yes — Compliant | Enforced HTTPS with HSTS (max-age=31536000; includeSubDomains), TLS 1.3 edge termination, encrypted database storage at rest, and Werkzeug scrypt/PBKDF2 salted password hashes. |
| HECVAT-AUD-01 | AUDIT — Tamper-Evident Audit Logging | Are administrative actions, grade modifications, logins, and data exports logged in a tamper-evident audit trail? | Yes — Compliant | Every sensitive event is recorded in AuditLog with a cryptographic SHA-256 hash chain (prev_hash -> entry_hash) verified continuously at /admin/audit and /admin/compliance. |
| HECVAT-BCDR-01 | BCDR — Availability, Backups & Disaster Recovery | Does the platform maintain health checks, database backups, and zero-VDI browser lab resilience? | Yes — Compliant | Continuous /healthz telemetry, 1-click encrypted database snapshot exports (/admin/backup), and 90 browser-native labs (including WebAssembly Linux VMs) that eliminate remote VDI server outages. |