# Training exports > Training exports: what the collector reads, how to connect it, its permissions, its certification by Atlantic Agentic Labs and its security posture. Built, not certified Built and tested against recorded and synthetic responses (version 1.0.0, 10 November 2026). Not yet run against the vendor's sandbox or a client environment. Reads training records exported by your learning management system, row by row, from a bucket prefix or a drop folder your deployment mounts, read-only. ## At a glance | Collector | Training exports, version `1.0.0` | | --------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | Reads | Any learning management system: LMS training-record exports ([the vendor's documentation](https://www.imsglobal.org/)) | | Family | Aviation | | Kind | Training | | Ways to connect | None (no credential), Service account | | Scopes | - Read: | | Read only | Yes | | Vendor's API can move money | No | | Personal data | Identity, Contact, Employment | | Hosts it may contact | Only the hosts on your deployment's allow-list (`*`: the host is the one you give it) | | Vendor API versions | CSV and JSON exports (no vendor API) | | Lowest engine version | `0.46.0` | ## What it reads - Every `.csv` file (and `.json` list of objects) under the prefix you name: each row is one record, keyed by `id_columns` and titled by `title_columns`. - An LMS exports completions as files; this collector reads those files and never connects to the LMS. For xAPI learning record stores see the `xapi` collector. ## How to connect 1. Make the export write to a bucket prefix, or to an SFTP server whose landing directory the deployment mounts. 2. Your engineer sets this source up in the source card (there is no key to paste): `store` (`s3://bucket/prefix/`, `gs://`, `azblob://` or `file:/path`), `id_columns` (what identifies a row), `title_columns` (the fields joined for the title), and for S3 a `role_arn` (and `external_id`, `region`). 3. Give the role read access to that prefix only. In LightHouse the card reads **Read**. ## Permissions - No credential is stored. The deployment’s identity, or the role it assumes, is the permission; grant list and get on the one prefix and nothing else. - The collector only lists and reads objects (and, for a `file:` store, reads files). It never writes, moves or deletes an export. Its read-only test uses a stub S3 client that records every operation and fails on any but list and get, and checks that a drop folder is byte-for-byte unchanged afterwards; there is no HTTP to record. - Nothing here connects to the system that produced the export, so nothing here could change it. ## Limits - Only files ending `.csv` or `.json` (a list of objects) are read; others are ignored. - A file is read again only when its ETag changes. Files larger than `max_mb` (50 by default) are skipped and counted. - Column names are the export’s own and none is assumed: set `id_columns` (otherwise a row’s hash is its id, so an edited row becomes a new record and the old one is withdrawn) and `title_columns`. - Rows that leave a file, and files that are removed, become withdrawals. - Google Cloud Storage and Azure Blob stores are read through the engine’s adapters, which need their own identity libraries in the deployment. ## Data handling - Records are read and indexed inside your deployment. LightHouse receives ids, hashes and counts, never a row. - Training exports name the trainee. Leave the name out (`exclude_fields`) where records are read for trends rather than people. - Contact fields and reporter names are left out by default, as are travel document numbers and dates of birth. `exclude_fields` adds columns (for example `**.Captain`); `keep_fields` takes a default back by its exact name. Nothing is cached raw. ## Troubleshooting | What you see | What it means | What to do | | ------------------------------------------- | --------------------------------------------------------- | ------------------------------------ | | `a source needs its label` | No label was given | Give the source a label | | `the store's prefix is a plain path` | The prefix holds characters a path cannot | Use a plain prefix | | Read succeeded, nothing written | No file’s ETag has changed since the last read | Nothing to do | | Fewer rows than expected | A file over `max_mb` was skipped (the source counts them) | Raise `max_mb`, or split the export | | A title of the form `: #` | `title_columns` is not set, or its columns were empty | Name the columns for the title | | Rows reappear as new records | `id_columns` is not set, so ids are row hashes | Name the columns that identify a row | ## Certification Each entry is a run by Atlantic Agentic Labs, newest first. Only a run against the vendor’s sandbox or a client environment certifies a collector; a certification lasts six months, or less if the vendor publishes an API version the collector does not list. See [How collectors are certified](/collectors/certification/). | Date | Collector | Engine | Vendor API | Method | Expires | | ---------------- | --------- | -------- | -------------------- | ----------------------------------- | -------------- | | 10 November 2026 | `1.0.0` | `0.47.0` | CSV and JSON exports | Fixtures only: built, not certified | Not applicable | ## Security posture From the collector’s last scan on the default branch. What each line means, and what blocks a release: [Security posture](/collectors/security/). | Last scanned | 10 November 2026 | | -------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Critical findings | 0 | | High findings | 0 | | Medium findings | 0 | | Low findings | 0 | | Info findings | 0 | | Release blocked | No | | Network allow-list check | Pass | | Read-only behavioural test | Pass | | SBOM (CycloneDX) | Produced | | Dependency licences | Pass | | Scanners | bandit 1.9.4, semgrep 1.181.1, pip-audit 2.10.1, osv-scanner 2.7.0, cyclonedx-py 7.5.0, pip-licenses 5.5.5, gitleaks repository job aal-secrets, hosts_check tools/hosts_check.py, read-only test pytest -m read_only | Source: https://docs.atlanticagenticlabs.com/collectors/catalogue/training-csv/