1
Signed Canvas launch
The service validates the LTI signature, issuer, audience, deployment, nonce, role, and launch state.
Security and trust
Secure testing for Canvas, with verifiable controls.
Canvas establishes who is acting. Safe Exam Browser enforces device policy. Safe Online Exam verifies the connection between them.
Layered verification
Trust flow
Four checks connect the right person, assessment, and policy.
The workflow stays simple for the user because the service performs the validation between Canvas and SEB.
2
Bound SEB configuration
The downloaded configuration carries the approved policy and a quit path bound to the assessment.
3
Current Config Key proof
A stale or changed configuration cannot produce the proof needed to receive the Canvas access code.
4
Canvas permission enforcement
Canvas continues to decide what the verified user may do in the course and assessment.
Verified safeguards
Short-lived state, controlled secrets, and separated custody.
These controls support the assessment experience without asking instructors or students to manage security machinery themselves.
Single-use launch state
LTI state is encrypted, valid for ten minutes, bound to the initiating browser, and claimed atomically in PostgreSQL.
Short-lived grants
Configuration grants last 120 seconds. Proof tokens are single-use and expire after two minutes. Application sessions last 30 minutes.
Controlled secrets
Access codes and passwords stay out of routine responses. Reveal and proof responses are no-store and bound to the verified principal.
Separated key custody
The service receives the public certificate. The private identity stays with the institution's device-management or BYOD distribution process.
Bound upstream access
Canvas API calls stay on the configured Canvas origin, use the application's scope set, and still honor each user's permissions.
Admission controls
Launch and token validation use local and PostgreSQL-backed budgets, with grant minting limited per principal and IP.
Certificate and BYOD operation
Use the strongest device binding your environment can support.
Certificate wrapping is the recommended default for managed fleets. Compatibility mode supports BYOD environments where private-identity distribution is impractical, while retaining Config Key proof, URL controls, one-time grants, the Canvas handoff, and SEB policy.
Safe Online Exam service
The public X.509 certificate, LTI signing key, and Canvas OAuth credentials.
The private client identity, its .p12 file, and its passphrase.
Your institution
The private certificate identity and the device or BYOD distribution decision.
Routine access for instructors, students, or the application runtime.
Boundaries and limitations
Know what the product does not replace.
- Compatibility mode does not make a downloaded configuration device-specific
- Safe Online Exam does not replace device management or operating-system policy
- Automatic Assessment Configuration on macOS can affect some assistive technology
- Each isolated Canvas tenant and environment needs its own deployment and state
Evaluate the workflow and the controls together.
We can demonstrate the user experience, then walk your technology and security teams through the trust model.