AI and live proctoring for certification bodies — every recording, identity check and verdict kept inside Saudi Arabia.
PDPL-resident Full system lockdown Evidence built to survive an appeal
The mode is a per-exam setting, so a high-stakes certification and a practice test can share one integration.
One API call with the exam and the candidate. You get back a link. No accounts to provision, no data entered twice.
ID document and selfie, matched against each other. A room sweep, a desk view and a phone as second camera when the exam asks for them. Available in English, Arabic, French and Italian, right-to-left included.
Webcam, screen and audio record in chunks that survive a dropped connection or a reloaded tab. The AI flags what it sees; on live exams a proctor is already watching, can message or call the candidate, and can hand over to a colleague.
Reviewers get a session, not a haystack: every detection is a click-to-seek marker on a seamless recording, with the model’s confidence next to it. They accept or dismiss each one, then approve or reject the attempt.
Automated proctoring fails an appeal the moment it cannot explain itself. Every signal here arrives with what raised it, how confident the model was, and the second of footage it came from — and no attempt is ever failed by software.
| Family | What is sensed | How it reaches a person |
|---|---|---|
| Identity | ID document against selfie at check-in; the candidate against that selfie for the rest of the attempt. | Face not matched — critical. Blocks nothing automatically; it puts the attempt in front of a human. |
| Camera | A second person in frame, the candidate leaving frame, sustained gaze off-screen, a phone or other object in shot. | Severity by label, each with the detector’s confidence and a temporal vote across frames. |
| Screen | Tab and window switches, fullscreen exit, a second monitor, clicks out to sites outside the allowlist. | Raised from the exam window itself, timestamped against the screen recording. |
| Audio | Speech during a silent exam, and more than one voice in the room. | Flagged for a listener; audio is recorded alongside the video, not transcribed. |
| Integrity of the record | Gaps in the recording, chunks that failed to upload, a session that ended without closing cleanly. | Surfaced as its own detection, so a thin evidence file is never mistaken for a clean exam. |
Each label carries its own confidence floor. An awarding body that cannot tolerate a false accusation raises it; one triaging volume lowers it. The setting is yours, not a vendor default you cannot see.
Every reviewer decision — accepted or dismissed — is recorded against the label that produced it, so you can see which signals earn their place and which waste your reviewers’ time, per cohort.
Reviewers get a queue ordered by severity, each detection a click-to-seek marker on a continuous recording. Sessions with nothing to answer for are visible as such rather than watched in full.
Certification decisions get appealed, audited and occasionally litigated. The evidence behind them has to be complete, attributable and demonstrably unaltered — months after the exam, in front of someone who was not there.
Each chunk is stored with its own MD5 and CRC32C checksum and storage generation, and the session carries a manifest hash and chunk count. A file that has been altered, or a recording missing a minute, is detectable rather than arguable.
Who watched a candidate, who read biometric data, who changed a threshold, who approved the attempt — with the reason, request and address, in an append-only audit trail. Elevated access is granted for a window and expires on its own.
A verdict keeps the reviewer, the timestamp, the note and the state of each detection at the time it was made — so an appeal panel can see the reasoning, not only the conclusion.
Retention reports before it removes, and nothing is purged silently while an appeal is open. Erasure is an explicit, audited action reserved to the highest role — and it clears the stored media, not just the database row.
Detection tells you what happened. Lockdown stops most of it happening — four layers of containment around every attempt, each one a per-exam setting, so a practice test and a high-stakes certification share one integration and behave nothing alike.
While the attempt is open, the candidate’s computer stops being a general-purpose machine. This is enforced by the operating system rather than watched for after the fact.
A proctored exam collects a face, an ID document, a recording of someone’s home and, with face matching, biometric data — the most sensitive categories the Personal Data Protection Law governs. Most proctoring vendors process all of it on infrastructure you cannot point to on a map, then ask you to sign a transfer agreement. This runs on Saudi soil, under keys you hold, on your retention terms.
Compute, database and recordings all live in the Kingdom. Nothing is copied to another region to be analysed, so there is no cross-border transfer to justify under Articles 29–30 and no transfer assessment to maintain.
ID photos, selfies and face templates are encrypted with customer-managed keys, read only by roles that need them, and every read is recorded against a named operator — so “who looked at this candidate’s face” has an answer.
A six-month retention window that reports before it removes, so nothing disappears mid-appeal. Deleting an exam hides its sessions without erasing evidence; erasure is a separate, deliberate, audited action.
A candidate asking what was collected, or asking for it to be erased, maps to one action with a record of who performed it — rather than a support ticket to a vendor in another jurisdiction.
StarCert Proctoring is built to support your obligations as data controller under the PDPL and its implementing regulations. It is infrastructure, not legal advice: the lawful basis, candidate notice and retention policy remain yours to set — and everything here is designed so you can evidence them.
A REST API and a browser SDK. Your platform stays the front door: the candidate never creates a second account, and lands back on your exam once check-in passes.
const res = await fetch('https://proctor.starcert.sa/v1/sessions', {
method: 'POST',
headers: {
Authorization: `Bearer ${token}`,
'Content-Type': 'application/json',
},
body: JSON.stringify({
external_exam_id: 'ISO-27001-LA',
student: { first_name: 'Layla', email: 'layla@example.com' },
}),
});
const { data } = await res.json();
// → data.session_link — send the candidate there.Windows, macOS and Linux, in Chrome, Edge, Firefox or Safari — plus the phone used as a second camera. No agent to distribute, no build to whitelist, and no cohort excused because of the laptop they own.
Session started, finished, flagged, reviewed — signed callbacks into your system so results land where your certificates are issued.
Compatibility endpoints accept the payloads your platform already sends, so exams and sessions can be pointed here first and the integration tidied up later — and you can run both in parallel while you satisfy yourself it holds.
The same integration runs a standard-browser attempt with tab, copy-paste and monitor checks, or a fully locked-down machine where the exam demands it.
Four fields. We come back with a figure and, if it helps, a session run end to end against one of your own exams.