How it works
Invigilo is one application a school installs, with named modules inside it: Vigila monitors exams, LUCA is the study model. Here is the flow from the exam opening to the recording being deleted, and where data lives along the way. None of it is in production yet.
The flow
The exam's level follows the exam regulations: at exams and the large written projects AI chatbots are prohibited, so it is level 0 or 1 of the four, which the school confirms. The exam leader sets the time and the seating chart. Nothing is collected yet; the client on the student’s computer waits for the server to open the exam.
Vigila
Vigila records only the exam window and masks the address bar and bookmarks before anything is sent. The rule engine flags what falls outside the school’s policy, and the invigilator sees the finding immediately.
The teacher signs in with the school’s own staff login and downloads one summary per seat: every finding with the rule behind it. Findings are decided by the teacher, never by the system.
When the appeal deadline expires, the server deletes the recording automatically. Deletion is built into the system, not a routine someone has to remember.
Launching in Q4 2026, ahead of the winter exams.
The archive knows only seat numbers. The student’s name lives in the school’s own roster and never enters Invigilo: not in the exam module, not in the study model. That is why there are three possible places for data and only the first two exist.
Self-hosted AI
When a teacher asks for an advisory assessment of a finding, the extract goes to a language model we run ourselves on a GPU server in the EU. LUCA, the study model, is built on the same footing and is still in development. There is no API call to OpenAI, Google or any other service outside Europe.
Some school tools run on OpenAI's GPT-4o and GPT-5.1. Even when the archive itself is stored in the EU, the conversation with the model is sent to OpenAI's servers in the US. That does not apply to our own models.
GDPR
Everything outside the exam window is stripped on the student’s computer before anything is sent.
The recording is used for one thing: the teacher’s assessment of the exam. Not statistics, not model training.
Automatic deletion when the appeal deadline expires. No clean-up anyone can forget.
Servers and models sit in the EU. There is no transfer to run a Schrems assessment on.
Every finding is decided by a human. That is Article 22 to the letter.
The school is the controller, Invigilo the processor, and the agreement is part of the subscription. Access and erasure go through the school, which is the only party that knows the names.
The authority’s proportionality test rests on an exam being short and bounded. Fourteen days of continuous monitoring is not, so SSO and SRP-style long assignments are monitored in bounded windows instead.
See for yourself
Open the demo and see the room, the findings and the invigilator’s view, no login required. It is Vigila as the module looks in closed testing.
