Trust as a property of the design, not the people.
aimeXM removes single-person trust from every sensitive step. Cryptography, separation of duties, biometrics and an append-only ledger combine so that leaks and forgery become detectable — and usually impossible — rather than merely discouraged.
Split-key custody
Root encryption keys are held by M-of-N smartcard custodians. Ceremonies are scripted, witnessed and ledgered. Developers never hold production keys.
Four-eyes release
Two senior officials must approve together for papers to unlock. No single person, however senior, can release a paper alone.
Tamper-evident ledger
Every action is written to an append-only ledger. Daily fingerprints are published — silent rewrites are mathematically impossible.
Biometric identity
Enrolment plus 1:1 verification on exam day. Impersonation is not a workflow the system permits.
Blind marking
Markers see answers, never names. Double-blind essay marking, auto-scored objective sheets, moderated deliberation.
Sovereign, default-deny
All data stays in-country on government-controlled infrastructure. Egress is denied by default and every access is recorded.
Several keys. Several people. One controlled unlock.
Root keys are split into shares distributed to trusted custodians. A quorum (say, 3 of 5) must be physically present and each present their smartcard for the vault to open. Every ceremony is witnessed, ledgered and reversible.
- FIPS-grade HSM roots of trust
- AES-256-GCM envelope encryption at rest
- OIDC + FIDO2 for privileged roles — no SMS fallback
- Attribute-based access: role + region + session + window
A logbook that cannot be quietly rewritten.
Every meaningful action — enrolment, authoring commit, release approval, print serialisation, centre check-in, marking, publication, certificate signing — is appended to a hash-chained ledger. A short daily digest is published publicly, so history cannot be edited after the fact without anyone noticing.
Read the model in the context of a live exam.
Walk through the ten-step lifecycle to see exactly when each control fires.