Learning delivery
RODMENA cmi5
Available on requestThe launching system that makes cmi5 courses behave as the standard says.
RODMENA cmi5 is the LMS side of the cmi5 standard. It imports cmi5 course packages, registers learners and launches any part of a course with its own single-use link. It checks a learning record from a course against the cmi5 rules before accepting it, and it decides completion and satisfaction by the course’s own criteria. Learning carries on when the RODMENA LRS is unavailable, because records are kept and forwarded to it in order.
Who it is for. Organisations and learning platforms that deliver cmi5 courses, including public-sector buyers who need learning records they can audit. It is used through its API by a learning management system, and learners never call it directly. REES is its first consumer.
- Status
- Available on request
- Part of
- Offerings
- Licence
- Proprietary. Copyright RODMENA LIMITED, all rights reserved.
- Conformance
- 21 cmi5 package tests, all passed
- 66 cmi5 runtime tests, all passed
- Verified 24 September 2026
- Tags
- cmi5xAPIe-learningCourse launchLMS integrationLearning records
Technical specification
Written for a technical assessor. A row with no measured value is left out.
Standards
- cmi5
- cmi5 (Quartz), with xAPI 1.0.3 as the statement format.
- Conformance suite
- ADL CATAPULT LMS test suite, run in headless Chrome against the running system.
- Conformance result
- Package tests: 21 of 21. Runtime tests: 66 of 66.
- Repeatability
- Both suites were run four times in a single day against the running system, and all four runs were identical.
- System of record
- The RODMENA LRS, to which cmi5 forwards all accepted records.
Course lifecycle
- Import
- cmi5 course packages are imported and their structure read from the manifest.
- Launch
- An assignable unit is launched with a single-use link, which cannot be replayed or shared into a second session.
- Rules at the door
- A course’s statements are all checked against the cmi5 session and verb rules before they are accepted, and a refusal names the specification requirement it breaks.
- Completion
- Completion and satisfaction are decided by the course’s own criteria, as the standard requires. We add no rule of our own.
- Return
- Where the learning management system supplies a return URL, the learner is offered a way back to it.
Durability
- Through an LRS outage
- While the LRS is unavailable, records are accepted and held, and learning continues. They are forwarded when it returns.
- Exactly once, in order
- Held records are forwarded exactly once and in order, and ordering holds across forwarded batches.
- Measured
- A ten-minute LRS outage with 200 learners produced no learner-facing errors. Afterwards we checked delivery of all held records against what cmi5 had accepted.
Isolation and security
- Tenant isolation
- Rules the database enforces keep customers’ data apart, in addition to the application code.
- Encryption at rest
- AES-256-GCM using keys bound to the row they protect.
- Learner identifiers
- The learning management system supplies the identifier as an xAPI account of home page and name, and email-style identifiers are refused. The application stores it as a keyed token and keeps an encrypted copy it can recover.
- Client addresses
- Never stored. Request logs carry a keyed token in place of an IP address.
- Stored objects
- Course packages and erasure records are encrypted on our host before they are uploaded to object storage.
Data protection
- Role
- A processor, acting for the learning management system customer, which is the controller. Article 28 terms are on the Data Processing Agreement page.
- What is processed
- The learner identifier the customer’s system supplies, and the learning records a course sends, including results and scores.
- Retention
- Per tenant and contractual. The defaults are 1,095 days for registrations and statement bodies, configurable down to one day.
- Erasure
- cmi5 pseudonymises a learner’s records at once, stops and removes their document copies in the LRS, and hands the erasure to the RODMENA LRS with a recorded receipt. One request therefore reaches both systems. A database restore includes a step that re-applies all erasures from sealed records kept outside the database.
- Operator reasons
- The reason recorded for an erasure or a deletion is a ticket reference or a code. Those records outlive the data and never hold free text about a person.
- Location
- The database tier stated in the Trust Centre, in the United Kingdom, France and Germany. There is no other transfer.
Integrations
- Document copies to the LRS
- Optional and off by default, per customer. Saved-state and learner-preference documents are copied one way to the RODMENA LRS and deleted there when they are deleted or reach retention. Session launch data is copied without its entitlement key.
- LRS cross-check
- On request, a registration’s statements are compared with the LRS copy, and a signed result for each statement is added to the evidence pack.
- Signed statements
- Optional, per customer. The statements cmi5 writes itself (launched, abandoned, satisfied, waived) carry an xAPI digital signature with RODMENA’s service certificate. The signature is removed with the statement body at retention or erasure.
- Webhooks
- Optional. Event notifications are signed with HMAC-SHA256 and go to HTTPS endpoints the customer registers. They carry only timestamps and ids the customer already holds, and no learner identifier or learning record. Events are kept for 30 days.
Exit and portability
- Return of data
- A customer requests an export through the API. It runs only after a second person approves it, is encrypted to the customer’s own key, and comes with a signed manifest covering all tables the customer owns.
- Deletion at contract end
- At contract end, the customer’s data is deleted and the customer receives a signed, timestamped deletion certificate that lists what was removed and what is retained for audit (the tamper-evident audit chain and its anchors).
Evidence
- Completion evidence
- Exported as a signed, timestamped pack that a third party can verify offline, without access to our systems.
- Timestamping
- A public RFC 3161 timestamp authority anchors the audit chain. At intervals of about fifteen minutes it receives a SHA-256 digest of a signed chain head, and only for a customer whose chain has changed. It is sent no personal data, identifiers or statements.
- If the authority is unreachable
- Learning, launches, statements and evidence export are unaffected. Anchoring retries on the next pass, and until then the newest audit rows are not yet covered by an anchor. A tenant’s health report shows how long they have waited.
Accessibility
Partially conformant with WCAG 2.2 AA. Our surfaces are designed to meet WCAG 2.2 AA because the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 place a duty on public-sector customers. The Equality Act 2010 binds RODMENA directly.
This product
- What this covers
- The four pages a learner sees. They are the launch page, the app launch page, the page shown when a link has expired or has already been used, and the error page. The app launch page (“Open your course in its app”) is shown in place of the launch page when a course opens in a separate app on the learner’s device. It never opens anything by itself and always waits for Continue. Course content belongs to the customer and is outside this statement.
- Automated testing
- axe-core 4, with WCAG 2.2 AA and its best-practice rules, run against the live pages on 26 September 2026. The result was clean in 20 checks of 20, covering five page forms (launch, app launch, expired with and without a way back, error) at desktop and phone widths in the light and the dark theme.
- Screen reader
- We tested all pages with Orca 46 and Google Chrome on Linux. A page is announced with its title or main landmark, and its single control as “Continue push button” or “Return to the course page link”.
- Keyboard
- Tested by keyboard alone in Google Chrome on macOS and Linux. On any page, the first Tab reaches its only control, which has a visible 3 px focus state. On macOS, Chrome and Safari skip links on Tab unless “Press Tab to highlight each item” is on, and Option+Tab reaches them either way.
- Without JavaScript
- The launch page submits on its own where scripting is available, and a visible Continue button is the path where it is not. Nothing on these pages requires a script.
- No time limits
- No countdown and no time limit is presented to the learner on any of the pages.
- Built from
- Plain semantic HTML with one main landmark, a single-column layout and a polite live region for status. No third-party user-interface framework is used.
- Not yet done
- Testing with VoiceOver, NVDA or JAWS, and TalkBack, and a third-party accessibility audit. Until the audit is complete the statement stays at partially conformant, and we will say so to any buyer who asks.
- Reporting a problem
- Accessibility problems with these pages go to the address on our accessibility statement, and we answer them there.
What it does
-
Conformance-tested
Passes the ADL CATAPULT cmi5 LMS test suite: 21 of 21 package tests and 66 of 66 runtime tests.
-
Rules enforced at the door
The statements a course sends are all checked against the cmi5 session and verb rules, and a refusal names the requirement it breaks.
-
Keeps working through an outage
Records are accepted and held, then forwarded exactly once and in order. A ten-minute LRS outage with 200 learners caused no learner-facing errors.
-
Isolated and encrypted
Each customer’s data is separated by PostgreSQL row-level security on its tenant tables; learner identities, xAPI statements and stored credentials are encrypted by the application before storage, and learners are looked up only by keyed tokens.
-
Evidence a third party can check
Completion evidence is exported as a signed, timestamped pack that verifies offline without access to our systems.
-
Erasure that reaches the LRS
A learner’s erasure is applied immediately in cmi5 and handed to the LRS with a recorded receipt.
For documentation, a pilot or an integration, contact us.