{
  "standard": "SOC2",
  "title": "Novak LMS\u2122 SOC 2 Trust Services Criteria (AICPA TSC CC1-CC9, Availability, Confidentiality, Privacy) Matrix",
  "platform": "Novak LMS\u2122",
  "url": "https://novak-lms.onrender.com/compliance",
  "generated_at": "2026-10-27T08:05:05Z",
  "contact": "novakornothing@gmail.com",
  "audit_verification": {
    "verified": true,
    "events_count": 15
  },
  "controls_count": 11,
  "controls": [
    {
      "criteria": "CC1.1 \u2013 CC1.5",
      "category": "Control Environment",
      "control_name": "Role-Based Governance & Institutional Ethics",
      "implementation": "Strict separation of Student, Instructor, and Administrator privileges (@role_required), institutional tenant scoping, and transparent privacy disclosures.",
      "status": "Active & Verified"
    },
    {
      "criteria": "CC2.1 \u2013 CC2.3",
      "category": "Communication & Information",
      "control_name": "Transparent Security, Syllabus & Privacy Specifications",
      "implementation": "Public machine-readable specifications (/specs, /llms.txt, /compliance), in-app privacy policy (/privacy), and explicit per-session consent dialogs for Helix telemetry.",
      "status": "Active & Verified"
    },
    {
      "criteria": "CC3.1 \u2013 CC3.4",
      "category": "Risk Assessment",
      "control_name": "Automated Threat Mitigation & Dependency Hygiene",
      "implementation": "Zero external CDN script dependencies (100% self-hosted vendor assets), strict Content-Security-Policy (CSP), X-Frame-Options, and X-Content-Type-Options: nosniff.",
      "status": "Active & Verified"
    },
    {
      "criteria": "CC4.1 \u2013 CC4.2",
      "category": "Monitoring Activities",
      "control_name": "Real-Time Health, TQI & Audit Chain Verification",
      "implementation": "Automated /healthz endpoint, Training Quality Indicator (TQI) packet monitoring, and live SHA-256 AuditLog hash-chain integrity verification.",
      "status": "Active & Verified"
    },
    {
      "criteria": "CC5.1 \u2013 CC5.3",
      "category": "Control Activities",
      "control_name": "CSRF Protection, Input Sanitization & Rate Limiting",
      "implementation": "Synchronizer CSRF tokens enforced on all state-changing POST/PUT/DELETE requests (HTML forms and fetch headers), SQLAlchemy parameterized queries, and login/API rate limiting.",
      "status": "Active & Verified"
    },
    {
      "criteria": "CC6.1 \u2013 CC6.8",
      "category": "Logical & Physical Access Controls",
      "control_name": "Authentication, Session Hardening & LTI 1.3 / SSO",
      "implementation": "HttpOnly, SameSite=Lax, and Secure session cookies; salted scrypt/PBKDF2 password hashes; SAML 2.0 / OIDC SSO; RSA-2048 JWKS signed LTI 1.3 Advantage handshakes.",
      "status": "Active & Verified"
    },
    {
      "criteria": "CC7.1 \u2013 CC7.5",
      "category": "System Operations & Incident Response",
      "control_name": "Tamper-Evident Logging & Operational Ticketing",
      "implementation": "Append-only SHA-256 hash-chained AuditLog for all authentication, gradebook, and data-export events, paired with built-in curriculum/system ticket triage (/admin/tickets).",
      "status": "Active & Verified"
    },
    {
      "criteria": "CC8.1",
      "category": "Change Management",
      "control_name": "Automated 1,000+ Test CI Gate & Schema Validation",
      "implementation": "Every release passes 972+ pytest integration/security/accessibility tests and 56+ Node.js unit tests, plus deterministic r0_sha curriculum stamp verification.",
      "status": "Active & Verified"
    },
    {
      "criteria": "CC9.1 \u2013 CC9.2",
      "category": "Risk Mitigation & Vendor Management",
      "control_name": "Zero Third-Party Subprocessor Lock-In for Labs or Gaze",
      "implementation": "All 90 labs (including 24 WebAssembly Linux VMs) and 478-landmark Helix gaze tracking execute locally in the user browser\u2014eliminating third-party cloud VM and video-proctoring subprocessors.",
      "status": "Active & Verified"
    },
    {
      "criteria": "A1.1 \u2013 A1.3",
      "category": "Availability",
      "control_name": "Stateless Web Workers, Brotli Asset Bundling & DB Backups",
      "implementation": "Immutable content-hashed CSS/font bundles with Brotli/Gzip compression, SQLite WAL / PostgreSQL pooling, and 1-click admin database backups.",
      "status": "Active & Verified"
    },
    {
      "criteria": "C1.1 \u2013 C1.2 & P1\u2013P8",
      "category": "Confidentiality & Privacy (FERPA)",
      "control_name": "Data Minimization, Self-Service Export & Right to Erasure",
      "implementation": "Students control their own education record via /my-data (full JSON export and account/record deletion request) with zero behavioral advertising.",
      "status": "Active & Verified"
    }
  ]
}