Independent testing
Penetration testing
A penetration test is a controlled attempt to break into a system, carried out by specialists, so weaknesses can be fixed before anyone else finds them.
About this page
Last updated: 10 October 2026.
This page describes how the Oxonia platform is designed to work. It is not a certification or an audit report. Our contractual commitments are in each university's order form, the data processing agreement and the service level agreement.
Our approach
Oxonia Academy plans to commission independent penetration tests of the platform. Tests are designed to cover the places where data enters and leaves: sign-in, the web and mobile apps, connections to learning platforms through LTI 1.3, payments and admin screens.
No completed independent test is claimed on this page. When a test is completed, we will publish its date and scope here.
What tests are meant to look for
- Ways to see records a role should not allow, such as another student's marks.
- Ways to change a record without leaving a trace in the audit log.
- Weak points in sign-in and sessions.
- Weak points in how files, such as exam scans and recordings, are uploaded and stored.
- Weak points in offline features on phones and tablets.
What happens after a test
- Findings are ranked by severity.
- Serious findings are fixed first.
- Fixes are checked, ideally by the same testers.
- A summary is prepared for customers.
Sharing results with universities
Universities and their security teams can ask for a summary of the most recent test under a confidentiality agreement once one is available. Ask when you book a demo.
Can a university test Oxonia?
Some universities want to run their own tests. Please do not test the live service without written permission. Email security@oxonia.ai first, and we will agree scope and timing.
Found something already?
If you have found a weakness, please report it through our vulnerability disclosure process. See also the security overview.
Testing is one part of a wider approach. It sits alongside careful design, limited access through roles, encryption and records of who did what. No test can prove a system has no weaknesses. Regular testing, quick fixes and an open route for reports are designed to keep the risk low and to keep universities informed. We will publish a short summary of each completed test on the trust centre, without details that could help an attacker.
Related