The paper exists before the exam
A printed paper is a valuable secret held by presses, couriers, strongrooms and centre staff for weeks. Leakage is what that design produces when it works as built.
TrustXD ExamOS is zero-leakage assessment infrastructure — hardware-attested identity paired with just-in-time exam generation, so a national examination can be sat from home with cryptographic integrity.
Prepared for national testing agencies, ministries of education and university examination boards.
A printed paper is a valuable secret held by presses, couriers, strongrooms and centre staff for weeks. Leakage is what that design produces when it works as built.
A photograph and a signature at a desk at 9 a.m. Proxy substitution survives because nobody is checking who is sitting there at 10:40.
Remote proctoring returns "87% suspicious" and a career turns on it. A candidate cannot cross-examine a number; a court cannot audit one.
Each failure ends the same way: cancellation, re-examination, litigation, a lost year for candidates who did nothing wrong — and a lasting reduction in public trust that no subsequent administration fully recovers.
None of these existed together five years ago. Every previous attempt at at-home high-stakes assessment failed on at least one of them.
Every incumbent guards the secret harder — more strongrooms, more cameras, more biometric gates at the centre door. We removed the secret.
On-device ID parsing, active liveness, a 468-point facial mesh, and a second camera at 60°–120° whose motion must correlate with the first. Every frame signed by a sealed chip.
A 3-second token painted on the exam screen, read by the phone, returned over an independent channel and validated inside a 2-second window on the server's own clock.
The item bank stays encrypted until locks A and B both hold. Then the generator writes this candidate's paper — and the IRT calibrator proves it is the same test.
Deterministic trails, three verdicts, independent reviewers, itemised bilingual consent, continuous self-view, and a 30-day purge that proves itself.
Level 1 browser-only · Level 2 dual-camera · Level 3 dual-camera plus attested status agent for national examinations.
They can — if you can measure it. Item Response Theory turns fairness from a promise into an enforced tolerance, checked before any candidate sees an item.
Item characteristic curves. Full derivation in the psychometric equivalence specification.
No field stores one, no API returns one, no configuration enables one. Every flag names the rule and the threshold that produced it.
Nothing else. "Not assessable" says the evidence was insufficient — it says nothing about the candidate, and always carries a free re-sit.
Append-only, signed, deterministic. A tribunal replays the session and gets byte-identical evidence — with the rule-set version it was judged under.
Candidates see their own evidence, their own reviewer access log, and their own retention clock. A system nobody can inspect is not a trust system, whatever it detects.
Findings of misconduct remain the institution's own decision. TrustXD supplies the evidence file and holds no opinion on guilt — which is precisely why the evidence file is worth something.
Revenue: per-candidate-session licence priced by assurance level, plus an annual platform subscription, plus a funded civic-node programme for candidates without a second device.
Indexed comparison of delivered cost per candidate. Centre-based delivery is set to 100.
Illustrative model, not a quoted price. It removes venue hire, printing, secure transport, invigilator deployment and candidate travel; it adds compute, media egress, reviewer capacity and the civic-node programme. Actual figures are modelled per programme during a pilot.
~5,000 candidates, run alongside the existing centre-based exam. Results not issued from TrustXD.
EXIT: ZERO DELIVERY INCIDENTS
Two university tests plus a banking recruitment shift, ~120,000 candidates, live results.
EXIT: FLAG RATE ≤ 4%
~600,000 candidates with civic nodes in aspirational districts, proving the equity model.
EXIT: NO DISTRICT SKEW
A national competitive examination at 2.5 million concurrent sessions.
EXIT: CLEAN STATUTORY AUDIT
Each phase publishes its own evidence: appeal-upholding rates, Not-assessable rates by district, and an independent DIF review. If the equity numbers do not hold, the phase does not advance.
TrustXD ExamOS · · Concept deck. Figures marked illustrative are modelling assumptions, not results.