§ Features
Everything the tool does, grouped by who it does it for.
For instructors
Assessment policy without leaving Canvas
One course-navigation placement. No separate console, no second roster, no access code to store in a spreadsheet.
Assessment discovery
Pull Classic and New Quiz data from Canvas, then enable SEB per assessment. Availability is re-checked against published state and the lock window.
Managed access codes
Enabling SEB creates and writes the code. It stays redacted by default; rotation is one action, and a reveal is a narrow, short-lived request.
Defaults & overrides
Set URL policy, password policy, and approved tools once per course. Any assessment inherits them or holds its own — and resets in one step.
Start & exit passwords
SEB cannot be enabled without an effective exit password, so a student cannot simply quit mid-exam. An optional start password protects the inner payload.
Approved exam tools
A course catalog of permitted tools, typed as exact URL, path-and-descendants, or a confirmed whole domain. Wildcards and unsafe patterns are rejected.
Role-aware by signed claim
Instructors get management; students get a launch-only flow. Roles come from the signed LTI launch — not a query parameter or page content.
For students
A short, checkable path into the exam
Connect Canvas once, optionally run a setup check, download a fresh configuration, take the exam. Nothing about it depends on the student behaving correctly for the controls to hold.
Setup check before exam day
A separate check config exercises decryption, SEB detection, connectivity, storage, and Config Key proof. It never releases a real access code, so it is safe to run any time.
Guided launch on the quiz page
A detector script loaded through your Canvas theme handles the SEB-required view, the launch handoff, and the approved-tool sidebar — on the real assessment routes.
Access code filled, not shown
After proof succeeds, the detector fills only an unambiguous Canvas access-code prompt. The student never sees or types the code.
Exit only after Canvas confirms
The quit link appears only on Canvas-authored completion evidence. Cancelling a submission confirmation does not exit.
For the institution
Operable, isolated, and yours
One deployment connects one Canvas tenant to one environment. That boundary is what lets you run a pilot, a test tenant, and production with no shared state.
Stateless service, durable store
Runtime state lives in Firestore, not process memory, so the service scales across instances without sticky sessions. Sessions, grants, proofs, and locks all expire.
Least-privilege by construction
The runtime account needs its own database and only its injected secrets. It never needs the private client identity — that belongs to your device-management platform.
Platform lockdown policy
Configs request Automatic Assessment Configuration on macOS and the kiosk / process-monitoring controls on Windows, with supported client version floors on both.
No per-seat metering
Self-host it and the software costs nothing per student, exam, or course. Prefer not to run it? The managed service prices the operation — not the enrollment.
Compatibility
What it plugs into
Deliberately narrow. A tool that claims to work with everything usually enforces nothing in particular.
LMS
Canvas
one tenant / deploy
Integration
LTI 1.3
course-nav placement
Assessments
Classic + New
same policy model
Client
Safe Exam Browser
macOS, Windows
Runtime
Node on Cloud Run
Gen2, containerised
Store
Firestore
transactions + TTL
Contracts stay stable. Public routes such as /lti/config, /.well-known/jwks.json, and /js/canvas-seb-detector.js do not move without a coordinated Canvas registration change.
Scope
What it deliberately is not
Worth stating plainly, because the category is crowded with products that blur these lines.
Not proctoring
No camera, microphone, recording, behavioural scoring, or human invigilator. Identity verification is a separate arrangement alongside this.
Not device management
It assumes a managed-device baseline; it does not create one. The private identity is deployed by your MDM, and version pinning is your policy.
Not a Canvas proxy
It calls a constrained set of Canvas endpoints on the configured origin. It is not a general gateway and does not mirror data it has no use for.
Not a replacement for SEB
SEB stays independent, free, and maintained by its own project. This tool is the Canvas-side integration around it.
See the flow these features add up to.
Seven steps from an instructor’s toggle to a confirmed exit.