Anyone can score an answer. The hard part is proving the sitting.
Every examination platform can deliver a question and mark it. What separates them is what remains afterwards: whether you can say who sat, what they saw, what was flagged and who decided. Xamina is built backwards from that question.
The four ways a high-stakes examination goes wrong
None of these are exotic. All four are ordinary Tuesday problems, and all four are unrecoverable once the sitting is over.
Who actually sat the paper
A remote candidate signs in with credentials that could belong to anyone, and the certificate you issue afterwards carries your organisation’s name, not theirs.
Identity check-in
Document read, face matched against it, name matched against the enrolment, all before the paper opens. Required per exam, and the attempt cannot start without it.
A named, verified sitter
The same paper, twice
One fixed form means the second cohort sits a paper the first cohort has already discussed, and there is nothing in the results that tells you which is which.
Seeded randomised pools
Each attempt draws to a blueprint (so many items at this difficulty, from that category) with a seed stored against the attempt, so the same draw can be produced again years later.
A form that does not travel
Disputes with nothing to show
A candidate appeals, and the only record is a score in a spreadsheet and an item that has since been edited. There is no way to show what they actually saw.
Snapshot + audit trail
Every attempt stores the questions as served. Every answer revision is kept. Every administrative change is written to an append-only log by the database layer, not by the code that made the change.
A reproducible paper
Surveillance without limits
Recording every candidate for the whole sitting creates hours of video of innocent people, a data-protection liability, and a review queue nobody will ever watch.
Flagged frames only
Frames are analysed in flight. Clean ones are discarded and never stored; only a frame that raised a flag is retained, and every flag lands in a queue where a human records a decision.
Evidence, not footage
Four decisions that are hard to retrofit
Each of these is cheap to build in from the start and close to impossible to add to a product that did not. That is the whole argument.
Organisations kept apart by design, not by a setting
Tenant scoping is a database client extension. A query that forgets its organisation does not return another organisation’s rows. It fails. Isolation that depends on every developer remembering a WHERE clause is isolation you are one pull request away from losing.
An audit trail that cannot be bypassed
The audit log is written by the same extension, on the write path, in the same transaction. There is no "and remember to log it" step, so there is no code path that quietly skips it, including the ones written next year by someone who never read this page.
Integrity policy is configuration, not a build
Strictness is per exam. A low-stakes formative quiz and a professional certification run on the same deployment with different thresholds, different identity requirements and different review rules. An administrator sets them, not a release.
Self-hosted is a first-class option
The same image runs on your infrastructure or ours, with no feature held back for the managed tier. For a ministry or a university with a data-residency rule, that is not a preference. It is the entire procurement question.
Against the two things people usually buy instead
A quiz tool with a proctoring service bolted on the side is a reasonable place to start. It stops being reasonable at the first appeal.
| Capability | Quiz tool | Proctoring bolt-on | Xamina |
|---|---|---|---|
| Authoring and item banking | Yes | No | Yes |
| Blueprint-driven randomised forms | Partial | No | Yes |
| Identity verified before the paper opens | No | Partial | Yes |
| Integrity flags reviewed in the same system | No | Yes | Yes |
| Per-attempt question snapshot for appeals | No | No | Yes |
| Tenant isolation enforced at the data layer | No | Partial | Yes |
| Immutable audit log across every module | No | Partial | Yes |
| Launches inside your existing learning system | Partial | No | Yes |
| Certifying body / voucher distribution API | No | No | Yes |
| Self-hosted with the full feature set | No | No | Yes |
Filled = present and integrated · dash = partially present or via a separate product · dot = not available.
Built for sittings that carry consequences
Universities
Departments that each own their banks, a registrar who owns the schedule, and an appeals process that needs the paper reproduced two semesters later.
Ministries & regulators
National sittings where the candidate list arrives from elsewhere, the residency rule is non-negotiable, and every administrative action has to be attributable.
Certification bodies
Paid sittings sold through certifying bodies, a voucher that must be single-use, and a refund rule that changes the moment a candidate actually sits.
Bring the sitting you are worried about
The useful demo is not ours. It is your hardest paper, your appeal process and your data-residency rule.