{
  "standard": "PRIVACY",
  "title": "Novak LMS\u2122 Zero-Video Client-Side Privacy, FERPA & GDPR Data Governance Report",
  "platform": "Novak LMS\u2122",
  "url": "https://novak-lms.onrender.com/compliance",
  "generated_at": "2026-10-27T14:09:13Z",
  "contact": "novakornothing@gmail.com",
  "audit_verification": {
    "verified": true,
    "events_count": 6
  },
  "controls_count": 4,
  "controls": [
    {
      "domain": "PRIV \u2014 Zero-Video Client-Side Biometric Privacy (Helix\u2122)",
      "id": "PRIV-RAM-01",
      "question": "Does the platform transmit or store student webcam video, images, or raw biometric recordings on external servers?",
      "response": "No Video Ever Transmitted \u2014 100% Client-Side RAM",
      "evidence": "Helix\u2122 478-landmark MediaPipe FaceMesh gaze tracking is strictly opt-in per session, executes 100% locally in volatile browser RAM via WebAssembly, and transmits only aggregate numerical dwell summaries. Saying no never affects grades."
    },
    {
      "domain": "DATA \u2014 FERPA & GDPR Student Record Ownership",
      "id": "PRIV-DATA-02",
      "question": "Is institutional and student education record data isolated, never sold, and exportable/deletable by the student?",
      "response": "Yes \u2014 Active & Verified",
      "evidence": "Strict institutional scoping (institution_id); zero third-party ad trackers or data brokers; self-service student record download (JSON) and erasure/correction workflow at /my-data."
    },
    {
      "domain": "SANDBOX \u2014 Browser-Sandboxed Lab Isolation",
      "id": "SEC-LAB-03",
      "question": "How are the 105 hands-on Linux, Windows, and Cisco labs isolated from the host machine and external network?",
      "response": "100% Browser-Sandboxed Execution",
      "evidence": "All 105 hands-on labs (including 24 WebAssembly v86 Linux VMs and 8 Ubuntu GNOME GUI + Bash workbenches) execute inside isolated client-side browser sandboxes with zero external network attack surface."
    },
    {
      "domain": "AI \u2014 Grounded Course Tutor Controls",
      "id": "PRIV-AI-04",
      "question": "Are AI tutoring features grounded in course curriculum with instructor controls and zero training on student PII?",
      "response": "Yes \u2014 Active & Verified",
      "evidence": "The Course Tutor retrieves strictly from course lessons, 5-path ladders, lab guides, and glossaries with source citations, refuses to hand out graded test answers, and can be toggled on/off per section by the instructor."
    }
  ]
}