# Novak LMS™ Zero-Video Client-Side Privacy, FERPA & GDPR Data Governance Report
- **Platform**: Novak LMS™ (`https://novak-lms.onrender.com` / `https://novakornothing.com`)
- **Generated**: 2026-10-27T14:08:00Z
- **Contact**: `novakornothing@gmail.com`

| ID | DOMAIN | QUESTION | RESPONSE | EVIDENCE |
| --- | --- | --- | --- | --- |
| PRIV-RAM-01 | PRIV — Zero-Video Client-Side Biometric Privacy (Helix™) | Does the platform transmit or store student webcam video, images, or raw biometric recordings on external servers? | No Video Ever Transmitted — 100% Client-Side RAM | Helix™ 478-landmark MediaPipe FaceMesh gaze tracking is strictly opt-in per session, executes 100% locally in volatile browser RAM via WebAssembly, and transmits only aggregate numerical dwell summaries. Saying no never affects grades. |
| PRIV-DATA-02 | DATA — FERPA & GDPR Student Record Ownership | Is institutional and student education record data isolated, never sold, and exportable/deletable by the student? | Yes — Active & Verified | Strict institutional scoping (institution_id); zero third-party ad trackers or data brokers; self-service student record download (JSON) and erasure/correction workflow at /my-data. |
| SEC-LAB-03 | SANDBOX — Browser-Sandboxed Lab Isolation | How are the 105 hands-on Linux, Windows, and Cisco labs isolated from the host machine and external network? | 100% Browser-Sandboxed Execution | All 105 hands-on labs (including 24 WebAssembly v86 Linux VMs and 8 Ubuntu GNOME GUI + Bash workbenches) execute inside isolated client-side browser sandboxes with zero external network attack surface. |
| PRIV-AI-04 | AI — Grounded Course Tutor Controls | Are AI tutoring features grounded in course curriculum with instructor controls and zero training on student PII? | Yes — Active & Verified | The Course Tutor retrieves strictly from course lessons, 5-path ladders, lab guides, and glossaries with source citations, refuses to hand out graded test answers, and can be toggled on/off per section by the instructor. |