Trust, Security & Privacy
1. Our Position
Section titled “1. Our Position”ExamNode exists to make high-stakes online exams harder to cheat on — not to collect more data about students than necessary to do that job. This page is a transparent account of what’s actually implemented today, what’s in progress, and what the architecture deliberately avoids. We’d rather under-claim than over-claim here.
2. What’s Already in Place
Section titled “2. What’s Already in Place”Your Data Stays on Your Infrastructure
Section titled “Your Data Stays on Your Infrastructure”- Local-First AI Evaluator: The AI integrity evaluator that reviews exam telemetry runs on a self-hosted open-source language model (Ollama / Llama 3.2) on our own infrastructure — not a third-party AI API. Student exam content, webcam telemetry, and spoken-response transcripts are never sent to OpenAI, Google, Anthropic, or any other external AI vendor for evaluation. This is a deliberate architectural choice, not a configuration option that could be silently changed.
- On-Premises Bot & Telemetry Detection: The browser automation detector (
local_agentdetect) stores all fingerprint signals and session heuristics directly in Moodle’s local database. Zero telemetry is dispatched to external cloud servers. - Local Keystroke Replay: Long-form response keystroke capturing, paste event logging, and the teacher writing replay tool (
tiny_cursive) operate natively within Moodle.
Third-Party Add-Ons & Data Processing Agreements (Cursive Cloud API)
Section titled “Third-Party Add-Ons & Data Processing Agreements (Cursive Cloud API)”- The advanced multi-submission authorship attribution and remote machine-learning analytics features in
tiny_cursivecan optionally interface with an external API (api.cursivetechnology.net). - Current Status: This cloud integration is active on the ExamNode testbed strictly as a Proof of Concept (PoC) demonstration under a trial key.
- Production Policy: We believe every institution must maintain complete sovereignty over its data boundaries. In production, this external cloud service is treated as an optional institutional add-on:
- Institutions requiring 100% air-gapped sovereign execution can disable external telemetry entirely; local keystroke logging, paste-blocking policies, and marker playback tools remain fully functional on-prem.
- Institutions electing to use the advanced authorship attribution service must establish their own direct enterprise licensing, Data Processing Agreement (DPA), and endpoint agreements with Cursive Technology Inc.
Network Isolation
Section titled “Network Isolation”- The database and session cache are never exposed to the public internet — they are only reachable from other services on the same internal network, with no publicly routable port at all.
- The AI evaluation service is bound to the server’s local loopback interface only, making it unreachable from outside the host regardless of firewall configuration.
- A host firewall permits only the minimum necessary ports (web traffic and administrative SSH access).
Transport & Access Security
Section titled “Transport & Access Security”- All traffic is encrypted in transit via TLS (HTTPS), with certificates automatically renewed.
- Administrative server access requires cryptographic key authentication — password-based login is disabled entirely.
- Automated intrusion prevention monitors and blocks repeated unauthorized access attempts.
- Operating system security patches are applied automatically.
Built on Moodle’s Privacy Framework
Section titled “Built on Moodle’s Privacy Framework”Our webcam monitoring subplugin already declares what personal data it collects (webcam snapshot metadata, timestamps, and event types) through Moodle’s core Privacy API metadata system, the same framework Moodle itself uses across core and all certified plugins.
3. In Progress — Being Built Out Deliberately, Not Rushed
Section titled “3. In Progress — Being Built Out Deliberately, Not Rushed”We’d rather tell you what’s not finished than claim it is:
- Full GDPR-style data subject request handling (export-my-data / delete-my-data) for our custom subplugins is partially implemented and being completed. Moodle’s core Data Registry tooling is installed but not yet fully configured with data purposes and retention categories.
- A published, formal site privacy policy and consent flow is not yet live.
- An explicit data retention/automatic-purge schedule for webcam monitoring snapshots is being designed — currently, snapshot data persists until manually reviewed and cleared by course staff, rather than on an automated timer.
- A formal third-party security questionnaire (HECVAT) response is being prepared for institutional procurement review.
4. Design Principles We’re Building Toward
Section titled “4. Design Principles We’re Building Toward”- Data minimisation. Collect only what’s needed to verify academic integrity — not continuous high-resolution video, not biometric identity matching, not browser-wide activity logging.
- Local-first AI. Keep evaluation models on infrastructure we control rather than routing student data through third-party AI APIs.
- Explicit retention limits. Exam integrity evidence should have a defined lifetime tied to the academic process it supports (appeals/grading windows), not indefinite storage.
- Institutional control. Partner institutions should be able to see, export, and request deletion of their own students’ data without needing to ask us to do it manually.
5. Questions?
Section titled “5. Questions?”If your institution’s procurement, legal, or privacy office has specific questions not answered here — including a formal HECVAT request — please get in touch directly rather than relying solely on this page. This page will be updated as each “in progress” item above is completed.