Security Architecture, Zero-Video Privacy, Section 508 (VPAT® 2.5) & SCORM/xAPI Trust Center
Verifiable technical security safeguards: 100% client-side RAM gaze processing (zero video transmitted), browser-sandboxed WebAssembly lab isolation, TLS 1.3 / RBAC / SHA-256 tamper-evident audit logging, WCAG 2.1/2.2 AA & Revised Section 508 accessibility, and native SCORM 1.2 / 2004 & xAPI 1.0.3 statement export.
1. VPAT® 2.5 — WCAG 2.1/2.2 Level A / AA & Revised Section 508 Accessibility Conformance Report (ACR)
Product Evaluated: rootLRN Adaptive Learning, Lab & Certification Readiness Platform · Evaluation Methods: Automated axe-core WCAG 2.1/2.2 Level AA suite, keyboard-only navigation audits, screen-reader live-region verification, and color-contrast validation across Light Mode and Dark Mode.
| Criterion | Standard / Requirement | Level | Conformance Level | Remarks & Technical Implementation |
|---|---|---|---|---|
1.1.1 |
Non-text Content | A | ✓ Supports | All 115 inline lesson SVG architecture blueprints, 10 multi-layer SVG diagrams, and 36 Hands-On Challenge topologies include descriptive role="img", aria-label, title/caption text, and accompanying HTML technical specification tables. |
1.2.1–1.2.5 |
Time-based Media & Audio Narration | A / AA | ✓ Supports | Built-in neural and local browser text-to-speech narration highlights synchronized words (.tts-word) directly against the complete written lesson text transcript. |
1.3.1 |
Info and Relationships | A | ✓ Supports | Semantic HTML5 landmarks (<header>, <nav>, <main>, <aside>, <section>, <footer>), <fieldset>/<legend> question stems, explicit <label for="..."> associations, and scope="col"/scope="row" table headers. |
1.3.2 |
Meaningful Sequence | A | ✓ Supports | DOM reading order matches visual layout across lessons, 5 Ways to Learn, Hands-On Challenges, and mobile responsive stacked tables. |
1.3.3 |
Sensory Characteristics | A | ✓ Supports | Instructions and status indicators never rely solely on shape, size, or visual location; all Hands-On Challenge nodes, mastery cells, and section steppers include explicit text badges and ARIA labels. |
1.3.4–1.3.5 |
Orientation & Identify Input Purpose | AA | ✓ Supports | Supports portrait and landscape orientations from 320px phones to widescreen desktops; authentication and onboarding forms provide standard autocomplete attributes. |
1.4.1 |
Use of Color | A | ✓ Supports | Mastery heatmaps, exam review grids, and Hands-On Challenge configuration badges pair color with text symbols (✓, ●, ○, S flag) and screen-reader status strings. |
1.4.3 |
Contrast (Minimum — 4.5:1) | AA | ✓ Supports | Verified via automated axe-core WCAG 2.1 AA sweeps across both Light Mode (#0f172a ink on #ffffff/#f8fafc surfaces) and Dark Mode (#f8fafc ink on #070d19/#0f172a surfaces), including search inputs and AI Tutor textareas. |
1.4.4 & 1.4.10 |
Resize Text (200%) & Reflow (320 CSS px) | AA | ✓ Supports | Responsive fluid typography and responsive table wrappers (.ui-table-wrap, table.table-stack) reflow cleanly at 200% zoom and 320px viewport width without horizontal page scrolling. |
1.4.11–1.4.13 |
Non-text Contrast, Text Spacing & Hover/Focus Content | AA | ✓ Supports | UI controls, form borders, SVG diagram nodes, and focus rings maintain >= 3:1 contrast; Escape dismisses drawers, modals, and live search popovers. |
2.1.1 & 2.1.2 |
Keyboard & No Keyboard Trap | A | ✓ Supports | 100% keyboard operable across lessons, 5 Ways to Learn, Practice Exam shortcuts (←/→, 1–6, F, W), Speed-Drill flashcards, Hands-On Challenge SVG nodes (Tab/Enter/Space), and CLI consoles. |
2.2.1 & 2.2.2 |
Timing Adjustable (ADA Exam Accommodations) | A | ✓ Supports | Instructors and administrators can grant per-student ADA time accommodations (1.25x, 1.5x, 2.0x) on Knowledge Tests and Practice Exams sittings, plus practice-mode server-side pause. |
2.3.1 |
Three Flashes or Below Threshold | A | ✓ Supports | Zero flashing content; strictly honors @media (prefers-reduced-motion: reduce) across all CSS transitions and JavaScript animations. |
2.4.1–2.4.7 |
Navigable (Skip Links, Focus Order, Headings, Focus Visible) | A / AA | ✓ Supports | Every page begins with a visible-on-focus "Skip to main content" link; high-contrast 3px outline focus rings; persistent 1-click Curriculum Sidebar and Section Stepper pills. |
3.1.1–3.3.4 |
Readable, Predictable & Input Assistance | A / AA | ✓ Supports | Explicit lang="en" attribute; inline accessible form validation with aria-invalid and aria-describedby error messages; non-destructive confirmation guards. |
4.1.1–4.1.3 |
Compatible & Status Messages (ARIA Live Regions) | A / AA | ✓ Supports | Dynamic updates in section checks, Practice Exam timers/autosave, Speed-Drill feedback, Hands-On Challenge CLI/Inspector outputs, and AI Tutor responses announce via role="status" and aria-live="polite". |
Section 508 Ch. 3, 5 & 6 |
Functional Performance Criteria, Web Software & Support Docs | Revised 508 | ✓ Supports | Full support for users without vision, with limited vision, without perception of color, without hearing, and with limited manipulation. Opt-in Helix webcam gaze tracking is 100% optional and never impacts grades. |
2. Zero-Video Client-Side Privacy, Browser Lab Sandbox Isolation & FERPA/GDPR Data Governance
Factual architecture controls verifying how rootLRN isolates student lab environments and processes webcam attention signals 100% locally in volatile browser RAM.
| Control ID | Architecture Domain | Technical Question | Status | Implemented Platform Evidence |
|---|---|---|---|---|
PRIV-RAM-01 |
PRIV — Zero-Video Client-Side Biometric Privacy (Helix™) | Does the platform transmit or store student webcam video, images, or raw biometric recordings on external servers? | ✓ No Video Ever Transmitted — 100% Client-Side RAM | Helix™ 478-landmark MediaPipe FaceMesh eye tracking is strictly opt-in per session, executes 100% locally in volatile browser RAM via WebAssembly, and transmits only aggregate numerical dwell summaries. Saying no never affects grades. |
PRIV-DATA-02 |
DATA — FERPA & GDPR Student Record Ownership | Is institutional and student education record data isolated, never sold, and exportable/deletable by the student? | ✓ Yes — Active & Verified | Strict institutional scoping (institution_id); zero third-party ad trackers or data brokers; self-service student record download (JSON) and erasure/correction workflow at /my-data. |
SEC-LAB-03 |
SANDBOX — Browser-Sandboxed Lab Isolation | How are the 137 hands-on Linux, Windows, and Cisco labs isolated from the host machine and external network? | ✓ 100% Browser-Sandboxed Execution | All 137 hands-on labs (including 40 WebAssembly v86 Linux VMs and 8 Ubuntu GNOME GUI + Bash workbenches) execute inside isolated client-side browser sandboxes with zero external network attack surface. |
PRIV-AI-04 |
AI — Grounded Course Tutor Controls | Are AI tutoring features grounded in course curriculum with instructor controls and zero training on student PII? | ✓ Yes — Active & Verified | The Course Tutor retrieves strictly from course lessons, 5 Ways to Learn, lab guides, and glossaries with source citations, refuses to hand out graded test answers, and can be toggled on/off per section by the instructor. |
3. Transport Encryption, Authentication, RBAC & SHA-256 Tamper-Evident Audit Architecture
Implemented application security safeguards, session hardening, password hashing, and cryptographic audit logging verified in the codebase.
| Control ID | Category | Safeguard | Status | Technical Implementation & Verification |
|---|---|---|---|---|
SEC-TLS-01 |
Transport & Session Encryption | TLS 1.3 / HTTPS & Hardened Session Cookies | ✓ Active & Verified | Enforced HTTPS with HSTS (max-age=31536000; includeSubDomains), TLS 1.3 edge termination, and HttpOnly, SameSite=Lax, Secure session cookies. |
SEC-AUTH-02 |
Authentication & Access Control | PBKDF2/scrypt Password Hashing, RBAC & LTI 1.3 / SSO | ✓ Active & Verified | Werkzeug salted scrypt/PBKDF2 password hashing, strict role-based access control (@role_required for Student, Instructor, Admin), SAML 2.0 / OIDC SSO, and RSA-2048 JWKS signed LTI 1.3 Advantage handshakes. |
SEC-CSRF-03 |
Request & Input Integrity | CSRF Protection, Parameterized Queries & CSP Headers | ✓ Active & Verified | Synchronizer CSRF tokens enforced on all state-changing POST/PUT/DELETE requests, SQLAlchemy parameterized queries, 100% self-hosted vendor assets (zero external CDN scripts), and strict X-Content-Type-Options: nosniff. |
SEC-AUDIT-04 |
Tamper-Evident Audit Logging | SHA-256 Cryptographic Hash-Chained Audit Trail | ✓ Active & Verified | Append-only SHA-256 hash-chained AuditEvent log (prev_hash -> entry_hash) for logins, gradebook changes, and data exports, verified continuously at /admin/audit and /security. |
SEC-OSS-05 |
Open-Source Toolchain Governance | 100% Permissive MIT / Apache-2.0 / BSD-2-Clause Runtime | ✓ Active & Verified | All client and server dependencies (v86 BSD-2-Clause, MediaPipe Apache-2.0, Bootstrap/Flask/SQLAlchemy MIT/BSD) are verified permissive with zero viral copyleft in the host runtime (/compliance/oss-licenses). |
4. SCORM 1.2 / 2004 (4th Ed) packages, xAPI 1.0.3 statement export & LTI 1.3
Works with any LMS that imports SCORM 1.2 or SCORM 2004 packages (for example Canvas, Blackboard, Moodle, or D2L Brightspace). Download ready-to-import SCORM 1.2 or SCORM 2004 (4th Edition) dispatch packages with real-time NOVAK_LMS_SCORM_EVENT score/completion synchronization and an xAPI 1.0.3 statement export (JSON). rootLRN is an xAPI 1.0.3 learning record store that passes the ADL LRS conformance suite (1,365 of 1,365). cmi5 support verified with the ADL CATAPULT test suite (LMS tests, 87 of 87).
IT Support (220-1201 / 220-1202)
13 chapters · 58 visual lessons · live Linux desktop & Windows 11 workbenches.
Basic Networking (N10-009)
7 chapters · 33 visual lessons · Cisco IOS Switch/Router CLI & 24 Linux VMs.
Operating Systems (FC0-U71)
6 chapters · 24 visual lessons · Windows 11 GUI & live Linux desktop labs.
Security
28 chapters · 153 lessons · 43 hands-on labs. Aligned to the CompTIA Security+ (SY0-701) exam objectives. Not an official exam.
5. Zero-Server Biometric Privacy, FERPA & Self-Service Student Data Portability (/my-data)
✓ 100% Client-Side RAM Gaze Processing · 0 Video TransmittedZero Biometric Video Transmission
Helix™ attention telemetry executes 100% locally inside the learner's browser WebAssembly sandbox (`@mediapipe/tasks-vision` + `OneEuro1D`). Raw webcam frames never leave device RAM and are never uploaded, recorded, or stored on any server.
Self-Service Data Portability & Erasure
Every learner and administrator has 1-click access to `/my-data` for machine-readable JSON educational record portability and cryptographic right-to-erasure / consent revocation logged in our SHA-256 hash chain.
100% Self-Hosted Assets & Permissive OSS Stack
Zero third-party ad trackers, zero external CDN font/script leaks, and 100% permissive MIT / Apache-2.0 / BSD-2-Clause client libraries (/compliance/oss-licenses).
Need a Technical Architecture Briefing or Institutional Security Packet?
Download the JSON/CSV/Markdown security & accessibility bundles above, schedule a 25-minute technical consult, or launch a 30-Day / 30-Student Free Institutional Pilot Bundle immediately.