# Novak LMS™ SOC 2 Trust Services Criteria (AICPA TSC CC1-CC9, Availability, Confidentiality, Privacy) Matrix
- **Platform**: Novak LMS™ (`https://novak-lms.onrender.com` / `https://novakornothing.com`)
- **Generated**: 2026-10-27T08:05:07Z
- **Contact**: `novakornothing@gmail.com`

| CRITERIA | CATEGORY | CONTROL_NAME | STATUS | IMPLEMENTATION |
| --- | --- | --- | --- | --- |
| CC1.1 – CC1.5 | Control Environment | Role-Based Governance & Institutional Ethics | Active & Verified | Strict separation of Student, Instructor, and Administrator privileges (@role_required), institutional tenant scoping, and transparent privacy disclosures. |
| CC2.1 – CC2.3 | Communication & Information | Transparent Security, Syllabus & Privacy Specifications | Active & Verified | Public machine-readable specifications (/specs, /llms.txt, /compliance), in-app privacy policy (/privacy), and explicit per-session consent dialogs for Helix telemetry. |
| CC3.1 – CC3.4 | Risk Assessment | Automated Threat Mitigation & Dependency Hygiene | Active & Verified | Zero external CDN script dependencies (100% self-hosted vendor assets), strict Content-Security-Policy (CSP), X-Frame-Options, and X-Content-Type-Options: nosniff. |
| CC4.1 – CC4.2 | Monitoring Activities | Real-Time Health, TQI & Audit Chain Verification | Active & Verified | Automated /healthz endpoint, Training Quality Indicator (TQI) packet monitoring, and live SHA-256 AuditLog hash-chain integrity verification. |
| CC5.1 – CC5.3 | Control Activities | CSRF Protection, Input Sanitization & Rate Limiting | Active & Verified | Synchronizer CSRF tokens enforced on all state-changing POST/PUT/DELETE requests (HTML forms and fetch headers), SQLAlchemy parameterized queries, and login/API rate limiting. |
| CC6.1 – CC6.8 | Logical & Physical Access Controls | Authentication, Session Hardening & LTI 1.3 / SSO | Active & Verified | HttpOnly, SameSite=Lax, and Secure session cookies; salted scrypt/PBKDF2 password hashes; SAML 2.0 / OIDC SSO; RSA-2048 JWKS signed LTI 1.3 Advantage handshakes. |
| CC7.1 – CC7.5 | System Operations & Incident Response | Tamper-Evident Logging & Operational Ticketing | Active & Verified | Append-only SHA-256 hash-chained AuditLog for all authentication, gradebook, and data-export events, paired with built-in curriculum/system ticket triage (/admin/tickets). |
| CC8.1 | Change Management | Automated 1,000+ Test CI Gate & Schema Validation | Active & Verified | Every release passes 972+ pytest integration/security/accessibility tests and 56+ Node.js unit tests, plus deterministic r0_sha curriculum stamp verification. |
| CC9.1 – CC9.2 | Risk Mitigation & Vendor Management | Zero Third-Party Subprocessor Lock-In for Labs or Gaze | Active & Verified | All 90 labs (including 24 WebAssembly Linux VMs) and 478-landmark Helix gaze tracking execute locally in the user browser—eliminating third-party cloud VM and video-proctoring subprocessors. |
| A1.1 – A1.3 | Availability | Stateless Web Workers, Brotli Asset Bundling & DB Backups | Active & Verified | Immutable content-hashed CSS/font bundles with Brotli/Gzip compression, SQLite WAL / PostgreSQL pooling, and 1-click admin database backups. |
| C1.1 – C1.2 & P1–P8 | Confidentiality & Privacy (FERPA) | Data Minimization, Self-Service Export & Right to Erasure | Active & Verified | Students control their own education record via /my-data (full JSON export and account/record deletion request) with zero behavioral advertising. |