Privacy by Design Exam Proctoring
Integrity monitoring built on an architecture that makes privacy violations structurally impossible — not just contractually prohibited.
No video, no audio, no screenshots leave the device during detection. The architecture enforces this — it is not a policy setting.
Face, gaze, and voice analysis compiled to WebAssembly and executed client-side. Vendor cannot intercept what never reaches the server.
Each tenant holds their own ECDSA P-256 private key. ProctorSafe cannot forge or tamper with session payloads.
Network monitoring logs only the domain name and timestamp of a suspect request — never the URL path, request body, or query parameters that could expose exam content or PII.
The difference between policy and architecture
Most online proctoring tools handle privacy through policy: they promise not to share your data, retain it only for a defined period, and process it in compliant data centres. These are real commitments — but they are enforced by contracts and audits, not by code.
ProctorSafe takes a different approach. The architecture is designed so that the most sensitive data — raw video, audio, facial geometry — is never transmitted to ProctorSafe's servers in the first place. A policy violation requires a bad actor with access; an architectural constraint has no such requirement.
The detection engine: Rust compiled to WebAssembly
Face detection
identifies face presence, multiple faces, and face disappearance using a convolutional model running at adaptive frame rates
Gaze / look-away detection
the GazeEngine estimates whether the candidate is looking at the screen, with debounce logic to suppress transient movements
SIMD executon
on browsers that support WebAssembly SIMD, the engine selects a SIMD-optimized build at runtime for higher throughput
Voice analysis without audio upload
Second-speaker detection uses the browser's getUserMedia API to access the microphone. The audio pipeline runs entirely in the browser:
- The preflight step captures a voice sample and computes a log-mel spectral profile and median F0 (fundamental frequency) for the candidate's voice.
- During the exam, the same pipeline computes the spectral distance between current audio and the enrolled profile.
- If the distance or F0 delta exceeds a configurable threshold, a
SECOND_SPEAKER_SUSPECTEDevent is emitted — containing only the timestamp, confidence score, and evidence metrics.
What reaches ProctorSafe: a structured event with numeric evidence. No audio samples, no voice recordings.
Network detection without URL surveillance
fetch and XMLHttpRequest to check the request hostname against a domain blocklist (ChatGPT, Claude, Gemini, Copilot, and similar services).- If no match: the request proceeds normally, nothing is logged.
- If a match: a `NETWORK_SUSPECT` event is emitted containing the hostname, HTTP method, and timestamp — never the full URL (which may contain exam content or PII).
Tenant-owned cryptography
- A ProctorSafe employee cannot inject false integrity events into a session
- A malicious actor with access to ProctorSafe's database cannot retroactively alter session evidence
What this means for your DPIA
| Processing activity | Traditional proctoring | ProctorSafe |
|---|---|---|
| Facial analysis | Cloud: vendor's AI system | In-browser WASM: candidate's device |
| Data subject of analysis | Candidate's biometric data at vendor | Candidate's local device only |
| Video storage | Vendor cloud (months/years) | Not stored (never transmitted) |
| Third-party AI processing | Yes (video → AI service) | No (WASM runs locally) |
Get started
- Try the interactive demo to see the SDK in action
- Contact us for a DPIA-support walkthrough
- Read our GDPR Article 25 guide
Related reading
Dive deeper with guides from our articles library.
WebAssembly (Wasm): The Secret to No-Install Privacy-First Proctoring
How WebAssembly enables high-performance in-browser proctoring without invasive downloads or kernel-level software.
Read articleRegulatory & complianceGDPR Article 25: Why “Privacy by Default” is the New Standard for Exams
How GDPR Article 25 changes remote assessment design: data minimization, default settings, and what “state of the art” means for proctoring.
Read articleRegulatory & complianceThe EU AI Act and Online Proctoring: A 2025 Compliance Guide
A practical guide to the EU AI Act (Regulation 2024/1689) for education and certification teams using (or evaluating) online proctoring.
Read articleFrequently Asked Questions
Common questions about privacy, compliance, and integration.
Ready to Get Started?
Try the interactive demo in your browser, or contact us for a walkthrough tailored to your program.