Exam delivery and integrity

Security that can survive being explained.

A server-held clock, a paper frozen at start, an answer key that never reaches the browser, and integrity signals a person reviews rather than a rule that voids — online, at a test center, and with remote proctoring in development.

Get a quote See pricing

Illustrative example

01 The answer key, the clock, the paper

Security that can survive being explained

The answer key never crosses the wire; grading reads it on the server after the sitting
A sitting's expiry is written once at Start and never recomputed
Item order and option order are drawn once, at start, and stored
Answers are saved as they are given

Every claim on this page is something you could describe to a candidate's lawyer. That is the standard a certifying body actually needs, and it is a different standard from the one a security feature list is written to.

There is exactly one function in the codebase that builds what a candidate sees, and it selects the columns it sends explicitly rather than taking the whole question row and deleting the key from it. The difference is the entire safety property: deleting a field is one refactor away from becoming a copy that quietly restores it, and that failure is silent, total, and discovered when a cohort's results turn out to be worthless. Grading reads the key in a different query, on the server, after the sitting is over.

A sitting's expiry is written once when the candidate presses Start and never recomputed. Every check derives the time remaining from it. The timer in the browser is a display of that number and has no authority — a candidate with developer tools can set a JavaScript variable to anything, and if that value can extend an examination then the examination has no time limit. Item order and option order are drawn once, at start, and stored: shuffling at render time would reshuffle the paper on every reload, which is indefensible, and would make a stored answer of "option 2" meaningless. Answers are saved as they are given, not at the end.

02 Online delivery

A frozen paper in the browser, a complete record on the server

The paper is frozen from the published form the candidate was admitted to
Autosave; a lost connection resumes the same sitting against the same clock
Written responses are handed in unscored and marked by people
Every sitting is reconstructable from its form

A candidate sits a published form — the one their window names, or one their window's pool handed them at admission — frozen at start. The browser shows the paper and saves answers as they are given; the server holds the clock, the key and the record. A lost connection resumes the same sitting against the same deadline. Selected and structured responses are scored on the server when the sitting ends; written responses are handed in with no score and no outcome until the last of them has a final mark from a person.

A surveyed sitting can end with a short questionnaire the candidate answers about the experience, kept apart from their result. Every sitting can be reconstructed from its form, its stored order and its saved answers — which is what a review or an appeal needs.

03 Integrity signals and review

Recorded and reviewed, never automatically fatal

Focus lost and regained, fullscreen exited and re-entered, a blocked copy, paste or context menu
Sittings whose signals cross a threshold go to a review queue
A concern is raised in words, answered within a window, decided with a reason, appealable to someone who took no part

The sitting records what the browser can honestly observe: focus lost and regained, fullscreen exited and re-entered, a blocked copy, a blocked paste, a blocked context menu. Sittings whose signals cross a threshold go to a review queue.

Nothing here voids an attempt on its own. That is a deliberate decision and it is the most important sentence on this page. A platform that voids on focus loss voids honest candidates with unreliable wifi, and the cost of that error — to the candidate, to your reputation, and in the appeal that follows — is far higher than the cost of a person looking at a pattern afterwards. Signals are evidence for a human decision, made with a reason the candidate reads, appealable to somebody who took no part.

This is also the argument against much of the industry's current direction. Automated proctoring that flags a candidate for looking away, or for a face the model reads poorly, generates false accusations that certifying bodies are now being sued over. A signal that a person must interpret cannot do that.

04 Test centers and proctors

Rooms, rosters, check-in and incidents

A body records where it delivers examinations — sites and their rooms — and who may supervise, and assigns a room and proctors to each appointment. The staffing board for a window says, appointment by appointment, whether the supervision is enough; it reports rather than refuses, because a shortfall is fixed by assigning a proctor, not by turning a candidate away.

Check-in records what the proctor saw: the kind of identification, its last four characters and expiry — never the whole number — whether name and photo matched, and how late the candidate was. Lateness is recorded, not ruled on. A proctor can extend a candidate's time, on the record. Incidents are reported by anyone who can read the roster and reviewed by someone who neither reported them nor supervised that appointment; an incident never voids, scores or releases anything itself — it can only be referred to the irregularity process that decides with a reason.

Sites and their rooms; a proctor roster your body controls
A staffing board says, appointment by appointment, whether supervision is enough
Check-in records what the proctor saw — never a whole ID number
An incident is reviewed by someone who neither reported it nor supervised the sitting

05 What is coming

Remote proctoring, in development

In development

Qualeron does not offer camera-based, microphone-based or screen-recorded proctoring today, and this page will not pretend otherwise. Identity verification by camera, live monitoring and recorded review are not part of the platform as it stands.

Remote proctoring is in development: the provider-neutral orchestration — a proctored session bound to a sitting, its events on the record, its outcome as evidence — is built, and the first provider adapter is being completed. When it ships it will follow the same rule as everything above: a signal is evidence for a person, not a verdict. If remote proctoring is a requirement for your program today, say so on the quote form and we will tell you plainly whether we are a fit yet rather than sell you a date.

Everything Qualeron does, A to Z — 42 services

Ask the hard questions

Tell us about your program.

Tell us how many candidates you certify and what you run today. You will get a written quote against the published plans — not a discovery call before a number.

Get a quote See pricing