Compliance and procurement documents

For IT security, privacy offices and procurement · LehrPuls 1.21.1 · November 8, 2026 · all documents free of charge, no registration

LehrPuls has no SOC 2 report, no data processing agreement and no LTI certification — because it has no cloud. The instructor's laptop is the server. Student responses are stored on that laptop and never reach the vendor; when participants join over the internet, the relay forwards end-to-end encrypted data it cannot read. The documents on this page describe exactly that, in the formats procurement usually asks for: an accessibility conformance report (VPAT/ACR), a vendor security self-assessment structured after HECVAT Lite (most answers: “N/A — no vendor-hosted data”), a data-flow statement for the privacy office, and an accessibility statement.

All four documents are self-assessments by the vendor, dated November 8, 2026. Where evidence is available only on request, the document says so. If your institution requires its own questionnaire, send it to office@lehrpuls.com; we complete it from these documents.

The documents

Accessibility Conformance Report (VPAT® 2.5 INT)

WCAG 2.2 Level A and AA, Revised Section 508 and EN 301 549, assessed separately for the cockpit, the projector view and the participant app. Based on axe-core scans of every view and scripted keyboard tests; known defects and untested criteria are listed.

Read online PDF (12 pages)

Vendor Security Self-Assessment (HECVAT Lite structure)

Every question area of the EDUCAUSE HECVAT Lite answered for LehrPuls: company, application security, authentication, data protection, third parties, continuity, change management, data center, privacy, quality assurance, vulnerability management; HIPAA and PCI not applicable.

Read online PDF (8 pages)

Data-Flow Statement

Components, data flows and a diagram: what stays on the laptop, what travels over the room network, what the relay sees (ciphertext and connection metadata), what the update check sends (the version number), and how license purchase through Paddle works. With a reading of the GDPR and FERPA roles.

Read online PDF (5 pages)

Accessibility Statement

After the W3C model statement, for the LehrPuls application and for lehrpuls.com: conformance status, known limitations with alternatives, how it was tested, and how to report a barrier.

Read online PDF (4 pages)

Where is the data hosted?

Question	Answer
Where are student responses stored?	On the instructor's computer, in one SQLite file in the user profile (or a folder your IT sets). Nowhere else.
Does the vendor have access?	No. No accounts, no remote access, no vendor backup, no telemetry.
What does the relay see?	Room code, connection metadata and AES-256-GCM ciphertext. The key stays in the join link's fragment and never reaches the server. Relay: Hetzner Online GmbH, data center in the EU; open source, self-hosting supported.
What does the application send to the vendor?	Optionally one request for the update manifest with the version number as User-Agent. Nothing else. The check can be switched off.
How is the license activated?	Offline: a signed key file verified in the application. No activation server.
Who processes payments?	Paddle.com Market Limited (London) as reseller and merchant of record, or purchase by invoice. The vendor never sees card data.

What we do not provide, and why

SOC 2 report. SOC 2 attests the controls of a service provider that processes customer data. LehrPuls does not host or process your data; there is no service to audit. The relay handles ciphertext only; its operation is described in the data-flow statement.
Data processing agreement (GDPR Art. 28). The vendor is not a processor for session data, because it never receives it. Institutions that need a document for their records can use the data-flow statement; a short processing statement for the relay is included in it.
LTI certification. LTI requires a hosted tool with OAuth 2 and JWT endpoints — a cloud. LehrPuls connects to your LMS through files and a local interface instead (next section). Nothing is installed in the LMS, and nothing needs approval from the LMS administrator.
Penetration test report. No external penetration test has been performed yet. The security self-assessment lists the internal checks and the open items honestly.

LMS-ready without LTI

Results get into your LMS, gradebook or analytics tool through open formats and a local read-only interface:

Raw data export as XLSX, CSV or JSON — one row per answer, with fixed column names that are documented as a contract, anonymized by default. Suitable for import into Canvas, Moodle, Blackboard or Brightspace gradebooks via their CSV import, after mapping the columns.
Participant lists can be imported from a spreadsheet exported by your LMS or student information system (XLSX/ODS; a template is provided in the cockpit).
PDF report per session for the course file, and a CSV balance per playlist.
Read-only interface on the instructor's computer (127.0.0.1, access key, anonymized by default) with ready-made templates for Power BI / Excel (Power Query), R and Python / Jupyter, plus a browser page for a quick look — see Tools for your own analyses.
Exchange format .lpx (ZIP with JSON) for questions, courses and playlists, documented at Help and documents, so content can be generated or archived outside LehrPuls.

Questions

Security, privacy or accessibility questions: office@lehrpuls.com. Legal details are in the imprint, data protection in the privacy policy, the license in the license terms. Procurement notes for IT (silent install, environment variables, network ports) are on the help page.