Skip to content

Exam Manager for IT and security reviewers

The mechanisms, described precisely

StudyDrome Exam Manager keeps each institution's data isolated by account and enforces that isolation at two independent layers: when a record is created and when data is read. This page describes the guarantee and the access, sign-in, audit, and file controls around it in the terms a reviewer needs.

Book a pilot

The pilot is free and time-boxed. Keep it if it works for your team; walk away if it doesn't.

How are institutions isolated from each other?

Every institution is a tenant. Every record it owns is bound to that institution's account.

Isolation is enforced at two independent layers.

A record cannot be created without an owning account, so an unattached record cannot exist.

And every read of tenant-owned data is restricted to the tenant making the request, even when a query does not request it. A defect in one layer is caught by the other.

The tenant is determined from the authenticated request itself. It is never taken from anything the caller supplies.

Before any endpoint runs, the request is checked against that tenant. The tenant must be active. The domain and the credentials must belong to it. And the client address must be permitted.

The address check is fail-closed. An address that cannot be read is refused, not allowed.

Departmental separation rides on top. A sub-account scope is honored only for callers who are entitled to it.

What this is, precisely: isolation by account, enforced at the application and data layers. Isolation reviews are recorded per module, against each milestone.

How is access controlled?

Permissions are granular and declarative. Every action is authorized against its own permission, not a role name.

That granularity is the point. An exam office holds invigilation rights without authoring rights. A psychometrician reads violation data, but cannot end an attempt. Publishing, grading, results export, results viewing, and question import are each a separate code.

Isolation is enforced at the data layer, independently of permissions. A misconfigured role cannot reach across tenants.

How do staff sign in, and how are sessions ended?

Institutions can bring their own identity provider. StudyDrome supports per-tenant OpenID Connect. Google, Microsoft, Okta, and generic providers are all supported.

Two provisioning modes are available. Just-in-time creates a recognized user on first sign-in. Pre-provisioned-only requires the account to exist already.

Sessions are short-lived and renewed under the platform's control. Renewal replaces the previous credentials, and anything replaced or revoked is refused on its next use.

Revocation is an action, not a wait for expiry.

Users can list their own active sessions. Each shows its address, browser and start time. They can end any of them.

An administrator with the sessions permission can end every session for a user. That is written to the activity log.

Deactivating an account locks it out and revokes all its sessions in one step.

What controls apply during an exam?

Exam delivery carries its own layers. Each is set per exam, and each works on its own.

Control

Mechanism

Access codes

Shared across a cohort, or unique per candidate. Held at test level, so republishing never forces redistribution

Address restriction

An allow-list accepting single addresses and ranges, checked when a candidate prepares, starts and resumes. Fails closed on an address it cannot parse

Device binding

An attempt can be tied to the browser profile it began on, checked on resume, with an invigilator able to release the binding when hardware fails

Academic holds

A hold carrying the exam-access restriction is checked at every point an exam can be reached, and fails closed if the hold cannot be confirmed

Attempt limits

Counted across every publication of a test, so republishing does not reset a candidate's allowance

Violations detected in the exam player are recorded on the server against the attempt. They are gathered into a per-attempt conduct report with a timeline.

On device binding, the honest description is the useful one. It identifies a browser profile. It guards against casual attempt-sharing. An invigilator can reset it.

What is recorded, and for how long?

A shared audit layer spans modules. Creates, updates, deletes, soft-deletes, and restores each record as its own type. Deletes capture the full prior value, not a diff.

Sensitive fields are redacted as they are captured. Personal data is masked again at render.

Records are kept for a retention period you set per account.

Several areas keep their own history alongside that layer:

  • Every grade, re-grade and un-grade writes a numbered row. Nothing is overwritten.
  • Question edits write sequential version snapshots.
  • Question banks keep a change history.
  • Proctor messages are stored with their delivery status, so you can evidence what a candidate was told.

Module access is controlled per tenant. Changes to that configuration, and access under it, are both logged.

How are uploaded files served?

Uploaded files are served through expiring signed URLs. Each link carries an expiry and a signature. A link that has been altered or has expired is refused.

Links are short-lived by default. Exam content and examiner sessions get a longer window, so a long sitting is never interrupted.

Files are accessible only via the platform's signed links. Storage paths cannot be guessed or walked. And a signed link is never persisted, so one cannot be recovered and replayed.

Third-party credentials held on your behalf are encrypted at rest. No endpoint ever returns them.

How is security verified before a release ships?

StudyDrome runs documented tenant-isolation reviews per module, with recorded PASS/SHIP verdicts. A security auditor passes every milestone.

Need more than this page covers? Hosting, data handling, sub-processors, your own questionnaire — bring it to a pilot conversation. We answer in writing.

How do staff sign in with our own identity provider?

Through per-tenant OpenID Connect. StudyDrome supports Google, Microsoft, Okta, and generic OIDC providers, configured per institution. Two provisioning modes are available. Just-in-time creates a recognized user on first sign-in. Pre-provisioned-only requires the account to exist before the provider will admit them.

How does StudyDrome keep our data separate from another institution's?

By account, at two independent layers. A record cannot be created without an owning institution. And every read of tenant-owned data is confined to the institution of the request, even when a query does not ask for it. The tenant itself is determined from the authenticated request. Never from anything the caller supplies.

How do we end a compromised session?

From the session list, or centrally. A user sees their own active sessions, including the address, browser, and start time for each, and can end any of them. An administrator with the sessions permission can end every session for a user. That is written to the activity log. Renewal replaces the previous credentials, and a revoked session is refused on its next use.

What is recorded when data changes, and how long is it kept?

Creates, updates, deletes, soft-deletes, and restores are each captured as their own operation type. Deletes record the full prior value. Sensitive fields are redacted at capture, and personal data is masked again at render. Records are kept for a retention period you set per account.

How are exam files protected from being shared?

Through expiring signed links. Each link includes an expiry date and a signature, so any altered or expired link is rejected. Links are short-lived, and exam content gets a longer window so a sitting is never interrupted. Files are reachable only through those links, and a signed link is never persisted, so one cannot be recovered and replayed.

How do we restrict where an exam can be taken from?

With an address allow-list that accepts single addresses and ranges. It is checked when a candidate prepares, starts, and resumes. So moving off-campus mid-exam will be noted on the next resume. It fails closed: an address that cannot be parsed is refused.

How is security verified before a release ships?

StudyDrome runs documented tenant-isolation reviews per module, with recorded PASS/SHIP verdicts. A security auditor passes every milestone. Does your review need detail beyond this page? Bring your questionnaire to a pilot conversation. We answer in writing.

Book a pilot

Bring your security questionnaire. We will work through it with you directly and provide a written response.

Book a pilot

Related