Learningby CodeLevel39
IT Request a demo

xAPI LRS · training with legal value

Every minute of training, proven.

Learning doesn't trust the browser. It records every event in a tamper-evident hash chain, recomputes time and coverage with its own clock and checks that a real person is on the other side. So the certificate stands up to an inspector.

Request a demo How it works
  • xAPI statements
  • SHA-256 chain
  • RFC 3161 timestamps
  • Multi-organisation
  • xAPIstandard statements, ADL verbs
  • SHA-256one chain per enrolment
  • 6 checksof presence, at random times
  • RFC 3161timestamp from a third-party authority
The principle

The client reports, the server judges.

The browser only sends raw events: page opened, video playing, tab in the foreground. The server recomputes time, coverage and outcomes with its own clock, and records the reason behind every verdict. A tampered client can lie, but it can't convince the server.

What the browser sends
  • experienced · page 410:02:11
  • visibility-changed · hidden10:02:40
  • video-sample · 2.0×10:05:03
  • completed10:09:58
  • progressed · time from the future11:30:00
What the server decides
  • Page 4 read for 29 sabove the rule's minimum dwell time
  • Hidden tab: time not creditedonly a visible, focused page counts
  • 2.0× speed above the maximumthat part of the video covers nothing
  • Statement timestamped in the futureanomaly recorded, not counted
verdict: incompleteengine v1 · reasons stored
Features

Built for those who must prove it, not just claim it.

Every feature answers the same question: if someone challenges a certificate tomorrow, what evidence do we have?

Presence checks

At random moments the course asks for a small proof: a drawn code, a sum, a question on the content, a tap on the right shape. The server sets the deadline: asking late doesn't buy more time.

Videos really watched

Coverage is the union of the parts watched at an allowed speed, with a position consistent with elapsed time. Skipping ahead and fast playback don't count.

Tamper-evident hash chain

Every event carries the fingerprint of the previous one. Tables are append-only and the integrity check re-verifies links, course definition and verdicts. Try it: change an event.

#1
#2
#3
#4
#5
Integrity verified

External timestamping

Every day the chain heads become a Merkle tree and its root gets an RFC 3161 timestamp from a third-party authority. Rewriting history is no longer enough: the root lives outside Learning.

Every organisation on its own

One address per organisation and data separated at every layer, from the token to the database. An organisation never sees another one's data.

Sign-in from your portal

Your server requests a single-use ticket with a signed API key; the user gets in with one click, without another password.

Rules that fit

Minimum time per page, video coverage, maximum speed, check frequency: organisation defaults, adjustable per unit and frozen in the published version.

Audit for inspectors

Auditors browse the full timeline of every enrolment, run the integrity check and recompute the verdict with the same engine that issued it. Corrections don't delete: they void, with a reason and an author.

Immutable course versions

A published course never changes: structure, rules and questions are frozen in the version, with their fingerprint. Years later you still know which rules every learner was judged by.

Open standards

Speaks xAPI, from day one.

At the heart of Learning is a Learning Record Store: every action is an xAPI statement, using ADL verbs wherever they exist. Your data isn't locked into a proprietary format.

  • Idempotent and atomicResending the same statement creates no duplicates; a batch goes in whole or not at all.
  • Identity from the token, never the bodyAn actor different from the authenticated user is rejected.
  • Canonical JSONEvery statement is stored in canonical form (RFC 8785), so its fingerprint can always be recomputed.
POST/api/statements
{  "id": "0192f7c4-5b1e-7a3d-9c2f-4e8b1d6a0f37",  "actor": { "account": { "name": "u-7f3a…" } },  "verb": { "id": "http://adlnet.gov/expapi/verbs/experienced" },  "object": {    "id": "https://learning.codelevel39.it/xapi/units/…"  },  "context": {    "registration": "7f3a…",    "extensions": { // player state      "…/ext/page": 4, "…/ext/visible": true    }  },  "timestamp": "2026-10-17T10:02:11.482Z"}
200 stored200 already stored409 same id, different content
Who it's for

When training has to count.

Public bodies and associations

Volunteers, civil protection, public administration: people to train and qualify, with evidence to keep.

  • Your organisation at its own address
  • Roles for administrators and auditors

Companies

Mandatory training and compliance: know who followed what, for how long and under which rules.

  • Configurable completion rules
  • One-click integrity check

Training providers

Courses sold to clients who demand proof of completion: give them an audit trail they can verify themselves.

  • One organisation per client
  • Exportable, verifiable evidence

Software vendors

Already have a portal? Learning plugs into it: SSO with signed tickets and xAPI statements, no need to recreate users.

  • API keys per portal
  • HMAC signature with path and nonce
Security and privacy

Only the data you need, properly protected.

  • IP and browser only if you want them. Enabled per organisation, kept outside the chain and deleted after the period you choose.
  • Short sessions. 15-minute access tokens kept in memory, renewal through a protected cookie, immediate revocation on password change.
  • Protected accounts. Hashed passwords, lockout with an alert after failed attempts, single-use reset links.
  • No secrets in clear text. Tokens, tickets and keys are stored only as hashes.
The roadmap

Foundations first.

  • Record store and validation engineChain, sessions, presence checks, verdicts, audit.
  • Users, organisations and SSOSign-in, roles, access from existing portals.
  • External anchoringMerkle tree and RFC 3161 timestamp.
  • Coming nextContent player, course editor, quizzes and certificates.
Let's talk

Training you can prove.

Tell us who you need to train and what evidence you need: we'll show you Learning on your own case.

Write to us
help@codelevel39.it · we reply within one business day