Questions institutions actually ask.

Safe Online Exam connects Canvas and Safe Exam Browser into one guided assessment workflow, so institutions can set up, support, and run locked-down Canvas assessments with less friction.

Yes. Safe Exam Browser is the lockdown client — free, open source, and maintained independently. Safe Online Exam is the Canvas-side integration that connects it to your Canvas assessment workflow. It does not replace the browser.

Yes. Classic and New Quizzes use the same Safe Online Exam placement and institutional approach, which helps teams avoid running two separate lockdown processes during a migration.

Instructors work from course navigation in Canvas: they find an assessment, enable SEB, and select any approved options the assessment needs. Safe Online Exam handles the protected handoff behind the scenes, so there is no separate portal or process to maintain.

No. There is no camera, microphone, recording, behavioural scoring, or human proctor. It restricts what the exam machine can do during the assessment and protects the access code. Identity verification or human invigilation is a separate arrangement.

Yes. Root-account administrators get a Canvas-embedded dashboard for connected courses, assessment status, controlled recovery actions, and reusable tool presets that can be applied across courses. It gives the Canvas or academic-technology team a practical way to support the rollout without taking over instructor work.

For managed hosting, we guide the institution through the Canvas and device-policy setup, then operate the service. For self-hosting, you need either Google Cloud or a Linux container host, PostgreSQL, a Canvas administrator who can manage the required keys and external app, and a device-management plan for the certificate identity.

Yes — there are two maintained modes. Google Cloud Run with Cloud SQL is the recommended managed path; Docker Compose on a Linux VPS is the other, using the same container image and PostgreSQL 17. Any host works if it provides PostgreSQL 17+, public HTTPS ingress, secret injection, a migration job that runs before traffic, and a scheduled cleanup job. PostgreSQL transactions and row locks back the atomic replay claims, one-time token consumption, and operation locks, so the database itself is not an arbitrary swap.

One per Canvas tenant and environment that must stay isolated — each with its own service, PostgreSQL database, secrets, and LTI registration. A test tenant and production do not share state, by design.

Yes. Canvas users' browsers navigate to it directly, so the service must be publicly reachable over HTTPS. Public reachability is not permission to bypass anything: every request still passes the LTI, session, and proof checks.

In your PostgreSQL database, on your own infrastructure. The service stores assessment and course settings, one Canvas OAuth grant per numeric Canvas user ID, sessions, and short-lived transient state. Sessions carry a 30-minute lifetime and every transient record carries an expiry that a bounded cleanup job drains in batches.

Two independent controls. The file is encrypted to a certificate whose private identity is installed only on approved managed devices, so it will not open elsewhere. And even on an approved device, the configuration must pass Config Key proof against current server settings before any access code is released.

The code is only returned inside SEB after proof succeeds, in a no-store response bound to the verified session, and it is filled into the Canvas prompt rather than displayed. Reaching that response at all requires a running SEB whose Config Key matches — which is the same as saying the lockdown is active.

Configurations students already downloaded are intentionally invalidated, because the settings fingerprint they carry no longer matches. Students download a fresh .seb file. This is the same mechanism that makes stale configurations fail — so policy changes want to happen outside an exam window.

Enabling SEB requires an effective exit password, so quitting needs it. The in-exam quit link appears only after Canvas confirms completion — a successful final submission with the matching result structure on a Classic Quiz, or the authoritative result UI on a New Quiz. Unbound quit routes return 410.

No. The service is given the public certificate and validates it at startup and at download time. The private identity and its passphrase belong in your restricted vault and device-management platform. That is a deliberate boundary, and the managed tier does not change it.

Safe Online Exam is opening to institutions now. Request a demo to talk through your environment, rollout goals, and the most appropriate way to begin.

They provide the same Safe Online Exam capabilities. Managed hosting adds the implementation help, operation, updates, and human support that many institutions prefer; self-hosting is for teams who want to own those responsibilities.

Pricing is being finalized by institutional size and support needs, without a per-seat or per-exam charge. A demo is the best place to discuss what a fit could look like.