AI connector security: what the AI can and cannot see

Short answer: The AI app sees only what a Mocxam tool returns, for the signed-in teacher's institute: exams, the question bank, and students' names, roll numbers, batches and results. It never sees passwords, payment details or other institutes. Every request is audit-logged, and access stops the moment a teacher disconnects.

Connecting an AI assistant to student data is a fair thing to worry about. Here is exactly how the connector is built, so you can decide with facts.

Sign-in and tokens

  • Each teacher signs in with their own Mocxam login through OAuth with PKCE. The AI app never sees the password
  • Access tokens last one hour and work only on the connector, not on the rest of the Mocxam API
  • Refresh tokens rotate on every use and are stored only as hashes
  • The plan is checked at sign-in, at every token refresh and on every tool call

Scoped to one institute

The institute comes from the token, never from what the AI asks for, so a prompt cannot reach another institute's data. There is no free-form database query tool.

Writes are limited

  • The AI can add questions; it cannot change or delete existing questions, students or results
  • Branding and staff changes are admin-only, previewed and confirmed
  • Every tool call is written to the institute's audit log

What happens to the data at the AI company

What Claude or ChatGPT does with the answers it receives is governed by Anthropic's or OpenAI's terms and the teacher's settings there, such as whether chats are used for training. Check those settings before connecting. Mocxam never sends data on its own; it only answers requests from an app a staff member connected.

Switching it off

  • One teacher: Disconnect in AI Connector on app.mocxam.com, or remove the connector in Claude or ChatGPT
  • Everyone: moving to a plan without the connector stops all connections at the next request

Frequently asked questions

Can students connect an AI to Mocxam?

No. Only institute admins and faculty can connect.

Is this legal advice on data protection?

No. This page describes how the product works. Your institute should decide its own policy on using AI with student data.

Where is the full privacy policy?

On the privacy page, which has a section on the AI connector.

Keep reading

Start free · Compare plans · AI connector · Blog · How it works · CBT exam software · Sign in · MockBazaar for students