Skip to content
Language: EN
Menu

Learning records

RODMENA LRS

Available on request

The evidence store for learning, recording what happened once and keeping it exactly.

Contact us

RODMENA LRS is a Learning Record Store. It receives records of learning activity in the xAPI format, stores them unchanged and returns them through the standard xAPI query interface. It passes all tests in the ADL LRS Conformance Test Suite for xAPI 1.0.3 and xAPI 2.0. The database itself keeps customers’ records apart from one another. Record contents are encrypted at rest. Learner identifiers are stored only in a keyed, pseudonymous form. Stored records cannot be altered, though a learner’s personal data can be erased on request and the erasures are written to a tamper-evident log.

Who it is for. Learning platforms and training providers that need a conformant store for learner activity records. It is a back-end service that products are built on and call from their servers, and learners and browsers do not talk to it directly. REES is its first consumer.

Status
Available on request
Part of
Offerings
Licence
Proprietary. Copyright RODMENA LIMITED, all rights reserved.
Conformance
1,365 xAPI 1.0.3 conformance tests, all passed
1,435 xAPI 2.0 conformance tests, all passed
Verified 23 September 2026
Tags
xAPILearning recordsConformanceMulti-tenantData protectionAudit trail

Technical specification

Written for a technical assessor. A row with no measured value is left out.

Standards

xAPI 1.0.3
ADL Experience API Specification, version 1.0.3
xAPI 2.0
IEEE 9274.1.1-2023
Version selection
Per request, by the X-Experience-API-Version header. 1.0.x and 2.0.x are accepted, and a missing or unknown version is refused with 400.
Conformance suite
ADL LRS Conformance Test Suite, last run 23 September 2026
Conformance result
xAPI 1.0.3: 1,365 of 1,365. xAPI 2.0: 1,435 of 1,435.
Beyond the suite
Where the suite says it does not test a requirement, a dedicated check covers it. We also found six suite tests that assert nothing and covered them separately.
By design
OAuth 1.0 is deprecated and is not accepted. Products built on the service call it server to server. It does not take cross-origin calls from a browser.

Interface

Resources
Statements, State, Activity Profile, Agent Profile, Activities, Agents and About. All GET routes also answer HEAD.
Authentication
HTTP Basic using credentials the service issues. Secrets are 256 bits and stored only as a keyed verifier. Unknown, disabled and expired credentials receive byte-identical 401 responses.
Alternate Request Syntax
Supported under 1.0.3 and refused under 2.0, as that specification requires.
Signed statements
JWS with RS256, RS384 and RS512, verified when a certificate is included.
Attachments
multipart/mixed, matched by SHA-2 hash. 5 MiB per attachment and 1 MiB per statement body, both configurable.
Paging
Signed stateless cursors that stay valid across a restart. All statements responses carry the xAPI consistency header.
Idempotency
Re-sending an identical statement id is accepted without duplication. A conflicting one is refused with 409.
Rate limiting
Per credential, plus a separate budget per client address for failed authentication.

Isolation and security

Tenant isolation
PostgreSQL row-level security, enabled and forced on every table holding tenant data. The application database role owns nothing and cannot bypass it. Each transaction takes its tenant from the authenticated credential alone.
Isolation, enforced
A catalogue test fails the build if any tenant table, or any partition created at runtime, lacks the policy.
Encryption at rest
AES-256-GCM on statement bodies, documents, attachments, activity definitions and credential identities, under a per-record key derived with HKDF-SHA256.
Ciphertext binding
A ciphertext is bound to the identity of its row and will not decrypt if it is moved to another row.
Key custody
Three keys held outside the database, in 0600 key files or the environment. There is no default key, and the service refuses to start without them.
Key rotation
The index key rotates by an offline, resumable rekey, and rotating the credential key reissues credentials. Because records store the id of the key that wrote them, a rotation needs no data migration.
Learner identifiers
Held only as HMAC-SHA256 tokens under a per-tenant key, and one learner in two tenants yields two unrelated tokens. No column holds a learner identity in clear.
Credential scopes
The xAPI scope set of statements/write, statements/read, statements/read/mine, state, profile, all/read and all. The narrowest reads only the statements that credential itself wrote.
Immutability
Database triggers keep statements and attachments append-only by refusing UPDATE, DELETE and TRUNCATE. The only permitted changes are the voiding flag and an erasure.
Database transport
TLS with full certificate and hostname verification is mandatory, and the service refuses to start without it.
Request audit events
One structured event per request carrying request id, credential key id, tenant, method, resource, status, record count, duration and filter names. Learner values in filters are tokenised before they are logged.
Tamper evidence
The erasure log is hash-chained, and a single command verifies the whole chain from the first link to the last.

Data protection

Erasure
A pseudonymising redaction. The learner is replaced by a random pseudonym in any position a statement can name them, free-text responses and attachments are removed, and their State and Agent Profile documents are deleted. Physical deletion is not used.
Erasure, recorded
Erasures are written to the hash-chained log. Because the command refuses an erasure that matches nothing, a mistyped learner cannot pass for a completed erasure.
Backups
An erasure is complete once backups taken before it have expired. After a restore, the erasure log is replayed.
Retention
By calendar month, per instance. The month is detached, exported as one file per tenant, and dropped. The drop is refused unless the exported row count matches.
Retention, per customer
A customer needing its own retention period needs its own instance.
Export on exit
Over the standard xAPI interface, a customer can page through all its records and their attachments as xAPI JSON and take the lot.
Residency
An instance runs in the region a contract requires. The service needs only a PostgreSQL database.

Operations and verification

Deployment model
A shared multi-tenant instance, or a dedicated instance per customer.
Probes prove they can fail
The harness will not count a pass from any of the 47 behavioural probes until that probe has been shown to FAIL against a deliberately broken build. We also run the conformance suite against broken builds.

What it does

  • Conformance-tested

    Passes all 1,365 tests of the ADL LRS Conformance Test Suite for xAPI 1.0.3, and all 1,435 for xAPI 2.0.

  • Records never change

    Once stored, a statement cannot be edited or overwritten, only voided, as the standard specifies.

  • Isolated by design

    Customers’ records are kept apart by rules the database enforces, in addition to the application code.

  • Encrypted and pseudonymous

    Record contents are encrypted at rest, and learner identifiers are indexed only as keyed tokens.

  • Erasure with an audit trail

    On request, a learner’s personal data is removed from their records, and the erasure is recorded in a tamper-evident, hash-chained log.

  • Scoped credentials

    A credential is limited to the operations it needs, down to reading only the records it wrote itself.

For documentation, a pilot or an integration, contact us.