§ Self-hosting

Self-host Safe Online Exam when your team wants to own the operation.

Self-hosting gives your institution the same Safe Online Exam capabilities as managed hosting. It also means your team owns the infrastructure, Canvas configuration, device-policy work, upgrades, and support process.

Source-available at release

The shape of a deployment

An institutional service with boundaries you keep

System of record

Canvas tenant

Browsers navigate hereLTI 1.3 launchConstrained /api/v1 calls

HTTPS ⇄

The service you run

Safe Online Exam · container

Stateless Node container. Scales horizontally; all state is external.

PostgreSQL 17 — all runtime stateSecrets — env vars or mounted filesCloud Run or Docker — the same image

Out of band · you keep this

Your MDM & device fleet

Private identity (.p12) — installed here, never extractableApproved SEB client, version-pinned

→ public certificate only

The one line that matters: the private identity is installed by your MDM and never touches the service — the service is given the public certificate and nothing more.

The work

The four responsibilities your team will own

These responsibilities fit naturally with teams that already run institutional applications and manage their assessment devices. The device-policy work deserves the same planning as the deployment.

Provision the project

Everything is environment-neutral. Choose names, URLs, and database IDs unique to this tenant and environment.

Cloud Run + Cloud SQL, or Docker ComposePostgreSQL 17 · secrets · migration jobDedicated runtime identityPublic HTTPS URL

Create the certificate identity

Plan this first — it involves your MDM, not your cloud console. The service gets the public cert; the private identity never touches it.

Generate, move private PEM/.p12 to a vaultDeploy .p12 by MDM — non-extractableInject only the public certVerify the published pk-hash

Register with Canvas

Two separate Developer Keys — the single most common place a first deployment goes wrong.

LTI 1.3 key from /lti/configAPI OAuth key with the right scopesApp installed at account scopeDetector loader in the theme JS

Verify before you trust it

Use separate admin, instructor, and student accounts, and finish on a real SEB client. Answering /health proves very little.

Enable one Classic + one New QuizDetector loads without console errorsProof + code fill on an approved deviceCancel vs submit exit behaviour

The stack

A focused, supported stack

Safe Online Exam uses a standard container-and-PostgreSQL deployment model. The details matter, but the architecture is deliberately focused rather than a collection of services to assemble.

Backend

NestJS 11 on Express

Frontend

React 19 · Vite

Runtime

Node.js 24 container

Store

PostgreSQL 17

Deploy

Cloud Run + Cloud SQL, or Docker Compose

CI/CD

Cloud Build · Dockerfile

Documentation

Documentation for the people operating it

The documentation follows the real implementation and covers the work an institution needs to complete, verify, and operate a deployment.

Architecture

Runtime design, trust boundaries, data model, route contracts, controls.

Canvas setup

Both Developer Keys, installing the app, API access, loading the detector.

Configuration

Environment variables, secrets, validation rules, local setup.

Deployment

Cloud Run + Cloud SQL and Docker/VPS provisioning, Build, IAM, releases, verification.

Certificate management

Creating, distributing, rotating, and validating encryption identities.

Testing

Automated checks, browser smoke tests, and the manual acceptance sequence.

A note on the boundary. Use a separate service, database, secret set, and LTI registration for every environment that must stay isolated. Pointing a test deployment at production’s database is the failure mode this design exists to prevent — the service refuses USE_IN_MEMORY_STORE=true in a hardened runtime for the same reason.

Prefer to keep your team focused on Canvas, not service operation?

That is what managed hosting is for. You receive the same Canvas SEB capabilities while we guide implementation, run the service, keep it current, and provide human support.

Request a managed demo →Repository