QPAssess

Trust center

How QPAssess handles your students’ data

QPAssess runs AI-moderated oral assessments: a student speaks with an AI examiner, the conversation is transcribed and provisionally scored against the instructor’s rubric, and the instructor reviews everything before any grade counts. This page describes — plainly and without certification badges we don’t have — what data the product collects, where it lives, who can see it, and what we have not built yet. Last updated June 10, 2026.

What we collect, and from whom

From students

  • Name and email, typed at the start of a quiz (or checked against an instructor-provided roster when the instructor restricts access). Students do not create accounts or passwords.
  • Microphone audio of the assessment conversation, and the resulting transcript.
  • Webcam and/or screen video, only if the instructor turns that mode on for a quiz — and only after the student sees a consent notice and clicks through it.
  • Scores and feedback: the AI’s proposed per-criterion scores, supporting transcript excerpts, and the instructor’s final scores and notes.

From educators

  • Name, email, institution, an optional role (e.g. professor or teaching assistant), and a password (stored hashed by Better Auth, never in plaintext).
  • Login session records, including IP address and browser user-agent, for session security.
  • For Canvas-connected accounts: the Canvas instance URL and which courses are synced. We do not store per-educator Canvas API tokens.

From website visitors

The landing page collects only what you type into the demo-request form (name, email, institution, role, optional message). There is no third-party analytics or ad tracking on the product.

Where data lives

  • Structured data (accounts, quizzes, rubrics, transcripts, scores) lives in a PostgreSQL database hosted by Supabase.
  • Recordings (audio, and webcam/screen video where enabled) live in a private Amazon S3 bucket. Playback links are signed URLs that expire after 15 minutes; the bucket does not allow public reads.
  • A full list of third parties that touch data — with what each one sees — is on the subprocessor & model registry page.

Encryption

  • In transit: browser↔app traffic is HTTPS; realtime audio/video to LiveKit uses encrypted WebSocket/WebRTC transport; calls to OpenAI and AWS use HTTPS.
  • At rest: S3 applies its default server-side encryption (AES-256, AWS-managed keys) to stored recordings, and the Postgres database relies on Supabase’s vendor-managed encryption at rest. We do not currently add our own application-layer encryption on top of these vendor defaults.

Authentication model

  • Educators sign in with email and password via Better Auth. Sessions are httpOnly cookies (never localStorage), marked Secure over HTTPS, expire after 7 days, and sensitive operations require a session fresher than 5 minutes.
  • Honest caveat: educator email verification is not yet enforced at signup; it is on the roadmap pending our transactional-email rollout.
  • Students don’t have accounts. When a quiz session starts, the server issues a short-lived signed token bound to that one submission; later requests (and the realtime room join) are verified against it, so a quiz link alone can’t be used to read or write someone else’s work.
  • Canvas / LMS launches use LTI 1.3: signed JWTs verified against the platform’s published keys, an issuer allowlist that fails closed, single-use nonces, and a deployment allowlist.

Recording lifecycle

  • Capture: audio is recorded during the assessment conversation. Webcam and screen capture happen only on quizzes where the instructor enabled them, after the student passes an explicit consent screen.
  • Storage: recordings are written to a private S3 bucket (one audio file per question; separate webcam and screen files when video mode is on).
  • Access: only the instructor who owns the quiz can play recordings, through their authenticated review dashboard. Playback URLs expire after 15 minutes. Students cannot replay their own or others’ recordings.
  • Deletion — honest version: deletion is manual today. There is no automatic retention schedule and no self-serve delete button yet; instructors ask us and we delete the recordings and rows by hand. An automated retention sweeper is planned before we onboard classes beyond the current pilots.

How AI is involved

OpenAI models transcribe the student’s speech, hold the examiner conversation, and propose a provisional score against the instructor’s rubric, with quoted evidence from the transcript. The AI never finalizes a grade: instructors review every response, can override any score, and only instructor-released grades reach the gradebook. Recordings of webcam or screen are never sent to any AI model. The full breakdown — which models, what they see, what is stored, and the vendor’s data-use policy — is on How AI is used, and what the AI examiner is known to be bad at is on Known limitations.

Security practices in place today

These are engineering rules enforced in the codebase and its CI today — not aspirations:

  • Every API route validates its input with a schema (lengths, ranges, ID formats) before touching the database.
  • Tenant isolation: every educator request walks the ownership chain, and non-owners get a 404 (the record’s existence isn’t even confirmed). Automated tests assert this on every change.
  • No student names or emails in URLs, and no raw-HTML injection points in the UI.
  • Internal webhooks are HMAC-signed with replay protection; admin endpoints use constant-time token comparison and fail closed when unconfigured.
  • Database-backed rate limiting on abuse-prone endpoints.
  • Configuration is validated at boot — the app refuses to start with missing or malformed secrets rather than running half-configured.
  • CI blocks merges on lint, type, and build errors and on auth-boundary test failures. Dependencies are scanned for known vulnerabilities on every change (currently warn-level, not merge-blocking, while a handful of transitive advisories await upstream fixes).

What we don’t claim

  • We are not SOC 2 or ISO 27001 certified, and we have not yet commissioned a third-party penetration test.
  • We do not advertise “GDPR compliant” or “FERPA certified” badges. We treat assessment recordings and transcripts as part of the student’s education record and say so in the student-facing consent notice; formal compliance programs come with institutional contracts.
  • We run in a single region (United States). There is no EU data residency option today.

If your institution’s review requires something not answered here, email jake@questionpunk.com — you will get an answer from the people who wrote the code.