Every part of a defensible online exam.
Identity settled before the paper opens, detection while it is open, and a human decision afterwards with the evidence attached. Here is how each piece works.
Settle who the candidate is before the paper opens.
Authentication is not identity proofing. However a candidate signed in, the identity check still runs: an ID document, a live selfie, and a name matched against the roster you supplied.
- The name is read from the ID document automatically. Adding a new country card is a configuration change, not a new integration
- The name is fuzzy matched against the roster, so spelling and ordering differences do not fail an honest candidate
- The live selfie is matched to the document photo at a high, configurable similarity threshold
- A failed match goes to a manual review queue. Nobody is silently hard blocked from an exam they are entitled to sit
No government registry, ever. ExamLense never calls a national ID database. Not the NIA, not the NIMC, not any equivalent. Verification is entirely self contained.
- Name on document
- AMA SERWAA
- Name on roster
- Serwaa, Ama
- Roster match
- Match, order differs
- Face similarity
- 98.4% (threshold 92%)
- Government registry contacted
- None
Watch at the depth the exam actually warrants.
Three tiers exist so an institution can buy the level of scrutiny an exam justifies rather than paying for maximum surveillance on every quiz. All three verify identity, watch for a face, lock the browser, and catch an extra display or a prohibited assistant. What changes is how much is captured and kept.
A locked browser that proves it is still locked.
SecureBrowser is a browser extension that confines the candidate to the exam window. The important part is the second half: it proves to us that it is genuinely running, rather than being taken at its word.
- New tabs close, and navigation away from the exam is blocked
- Clipboard, downloads and printing are disabled for the session
- Lockdown status is confirmed on our side. A client claiming to be locked is not evidence that it is
- Because it is optional on two tiers, the exam itself also detects an extra display, a duplicate window and prohibited AI extensions without it
Optional
Display and extension checks run without it.
Recommended
Closes the gap between screen evidence and a locked room.
Required
The evidentiary chain has to be complete.
A person decides, with the evidence in front of them.
Flags and risk scores are inputs to a human decision, never a verdict. Risky sessions are promoted into review cases and land in a queue with the evidence attached.
- A live monitoring grid for sessions in progress, updating as the exam runs
- An evidence timeline that puts every flag beside the moment it occurred
- Dismiss, confirm a violation, or escalate, with the reasoning recorded
- High-stakes exams can require a second reviewer to agree before a violation stands
- Reviewers cannot alter exams, rules or licences, and administrators cannot overturn a review decision
Evidence timeline
Rules v3, in force at sittingThe server is the referee.
The candidate machine is not trusted with anything that matters. Timing, scoring and licence consumption are all decided server side, which is what makes a result defensible.
- The countdown runs on our side. A candidate who changes their own clock changes nothing
- Answers auto-save as the candidate works, so a crash costs seconds rather than a paper
- Disconnection is a pause with a configurable grace period, not a failure
- Force submit at zero, and a licence consumed in a single atomic step so a pool cannot be oversold
- Exam rules are versioned, and the version in force is stamped onto the session and never mutated afterwards
- 01:12:40 Clock held on our side
The candidate machine only displays it.
- Reconnecting Paused, not failed
Grace period counting. Answers already saved.
- v3 Rules stamped at sitting
A later rule change never rewrites a past session.
- 1 credit Consumed atomically
Reserved at registration, spent at session start. Exact under load.
Launches from the system your institution already runs.
Candidates never create ExamLense accounts. They arrive through one of three routes, and all three end in a short-lived token scoped to a single exam. Staff sign in separately, with multi-factor authentication.
Integrations, explained- ROUTE 1
LTI 1.3
Every major LMS supports it, so the launch, the roster sync and the grade return all work out of the box.
- Moodle
- Canvas
- Blackboard
- D2L
- Sakai
- ROUTE 2
Single sign‑on
From your own identity provider, over OIDC or SAML.
- Microsoft Entra ID
- Google Workspace
- Okta
- ROUTE 3
Passwordless
An invitation link plus a one-time code by email or SMS, for candidates with no institutional account.
- SMS
Run the whole exam from one console.
Built for an examinations office, not an IT department. Create the exam, let the roster arrive from your LMS, buy credits invoice first, and watch the sitting live.
Every exam carries its own tier and its own rules.
Title, course, window, the oversight tier the stakes justify, and whether two reviewers must agree. The rules version in force is stamped on every session and never edited afterwards.
- Tier chosen per exam, so a quiz is not recorded like a final
- Two-reviewer sign-off switched on for high-stakes papers
- Rules v3 stamped on the session at sitting time
The roster arrives from Moodle. Nobody types it in.
One LTI 1.3 connection covers the launch, the roster sync and the grade return. Students arrive from the course page and never create an ExamLense account.
- Names and student IDs synced from the LMS
- Roster is what identity verification matches against
- Grade return switched on at the same time
Prepaid credits, invoice first, credited by a person.
Request the sessions you need for a tier. An invoice is issued, the finance office pays by bank transfer or mobile money, and a second operator approves the batch before the pool is credited.
- ExamLense stores no payment details
- Maker-checker on every credit batch
- Low-balance alerts fire before a window opens
Watch the sitting, then return the grades.
The monitoring grid shows every session. A flag goes to a reviewer, a dropped connection pauses the candidate, and when the window closes results publish and grades return to the LMS.
- Flags become review cases, never automatic verdicts
- Reconnecting candidates resume with the clock unchanged
- Grades returned to Moodle in one step
What a candidate actually goes through.
-
The document is captured with framing guidance, so the first attempt usually passes. -
A live selfie is matched against the document photo before the paper opens. -
The session runs in a locked browser, with the clock held on our side. -
Flagged sessions reach a trained reviewer with the evidence attached.
Verification on its own, and screens without a camera.
Both are configurations of the same session rather than separate products, so they behave the same way and are bought the same way. Both consume a Lite credit.
- 01
Identity only
The candidate verifies and the session ends. For enrolment, credential checks and pre-screening where no examination follows.
- 02
Screen monitoring only
Desktop evidence with no camera at all. For workplace compliance testing where camera monitoring would be disproportionate, and for candidates whose accommodation excludes camera use.
See the whole chain on one of your own exams.
We will run a sitting end to end, including a deliberate flag, so you can see exactly what a reviewer would be looking at when they make the call.