Proctoring & privacy

Face and voice detection run in the browser, in a worker. The model layer produces abstract signal samples — how many faces, head angle, whether the gaze is off-screen, whether speech is active — and a pure flag engine turns those into debounced events.

Only the events are sent to the server. There is no video stream, no audio upload, and no frame storage in the advisory path.

Advisory — camera and microphone

A signal must persist past its threshold to flag, and repeat flags of one type are debounced, so a blink or a cough does not produce an event.

Lockdown — integrity events

Tab switches, leaving full-screen and focus loss. Unlike advisory flags, these do drive the client-side warn-then-auto-submit behaviour.

• It never auto-fails anyone on an advisory flag. A flag is an observation a teacher reads alongside the attempt.
• It never uploads video or audio in the advisory path.
• It never runs silently. A pre-check screen requests camera and microphone permission explicitly before the attempt starts.
• It never identifies a person. The model counts faces and estimates angles; it does not recognise who they are.

Where captures are stored at all, they are written with a per-institution key and purged on the retention schedule. Flag events are retained with the attempt as part of its record.