Most assessment tools are a test engine with an admin screen bolted on
That is fine until you are a provider serving multiple client organisations, each on a different plan, each with their own entitlement, each subject to somebody’s privacy regime — and someone asks you to prove that a result was never seen by a person who should not have seen it.
✗What breaks at provider scale
- Entitlement is a spreadsheet, so a client quietly consumes assessments they were never licensed for.
- Every staff member can see every candidate result, because the permission model has two levels.
- The audit log is a table that an administrator can edit.
- Data residency is a promise in a contract rather than a property of the system.
- Accessibility is an add-on SKU, and the item bank has no calibration story at all.
✓What Clarent does instead
- Entitlement is enforced at the database. Allocating an unlicensed instrument raises insufficient_privilege at the trigger.
- Row-level security on every tenant table, forced on the application role — clinical results require a clinical role.
- The activity trail is append-only and hash-chained: every row carries the hash of its predecessor.
- Each tenant is pinned to one of seven regions, and there is no cross-region processing.
- WCAG 2.2 AA is native, and items move scaffold → authored → reviewed → calibrated before any real decision.
The whole provider operation, in six screens
This is the console a provider runs their business from — not a candidate-facing test player.
A command centre for the whole portfolio
Active tenants, instruments licensed, sessions in flight and units consumed across every client. The tenant portfolio shows plan, licensing model — per-user, per-assessment or hybrid — entitlement, consumption against limit and the frameworks each client holds. Framework reach shows how far the catalogue actually penetrates your book.
Results that stay de-identified by design
An aggregate view where the role genuinely cannot resolve individual candidates. Percentile distribution against the norm set, standing bands, and filters that compose across framework, instrument, cohort, band, validity and time window. The interpretive note is built in: a spike at the ceiling usually means the form was too short, not that everyone did well.
Access with a boundary you can point at
Accounts exist for a role inside a defined scope and nowhere else — the boundary is the point of the screen. Client organisations, provider staff accounts and emergency break-glass accounts scoped to one named client site, with the functions chosen one by one and a second factor required on every account.
An activity trail that detects its own tampering
Append-only and hash-chained: every row carries the hash of its predecessor, so a deleted or edited event breaks the chain and is detectable. Chain status is verified and displayed. Seven-year retention. Filters compose across person, activity kind, exact action, instrument, allocation and organisation.
Security posture as a page anyone can read
All ten OWASP Top 10 categories answered at design level with abuse-case tests, plus the privacy and residency controls that matter for Australian education and health data. TLS 1.3 only, AES-256 at rest with per-tenant envelope keys in a managed HSM, signed artefacts with provenance attestation, and a deny-by-default egress posture.
An item bank with an honest calibration story
20,400 questions across 68 instruments and 469 scales, 300 per instrument, blueprinted by scale, format and difficulty tier. Formats span Likert, situational judgement, frequency, rater, forced-choice pairs and multiple choice. Scaffold items are labelled as scaffold — the workflow moves them to authored, reviewed and calibrated before an instrument is cleared for a real decision.
Take the full tour
Six screens from the working console.
Provider-grade from the first screen
Multi-tenant by construction
Row-level security on every tenant table, forced on the application role. Isolation is a database property, not application logic.
Three licensing models
Per-user, per-assessment and hybrid, with seat blocks and assessment credits tracked against the entitlement.
Licence request workflow
Clients ask, you approve all, some or none with a note back. The decision and its reason are on the record.
Gradebook and delivery
Sessions in flight, delivery status and marking progress across every tenant in the portfolio.
Norm sets
Results scored against a named norm set, with the norm identified on every distribution so comparisons stay honest.
Clinical governance gate
Clinical frameworks cannot be granted until a registered governance contact is recorded against the tenant.
Accessibility, natively
WCAG 2.2 AA across the candidate and administrator experience — not a separate accessible build.
Seven regions
Each tenant pinned to one region — AU-Southeast, UK, NA, Global and others — with no cross-region processing.
Verifiable exports
Exports carry a SHA-256 the recipient can check, so a report’s integrity is provable after it leaves the platform.
The security page we let clients read first
Most vendors send a questionnaire response. Clarent ships the answers as a screen inside the product.
How a provider goes live
Catalogue
Your instruments, scales and norm sets are loaded and blueprinted, and the item bank is staged into the calibration workflow.
Commercials
Plans, licensing models, entitlement rules and credit blocks are configured to match your contracts.
Tenancy
Client organisations are created with their region, plan, contract and first administrator — entitled to nothing until you grant it.
Assurance
The security posture page, the activity trail and the export verification are walked through with your clients’ risk teams.
Straight answers
A platform. The candidate experience is one part of it; the rest is the provider console — catalogue, licensing, entitlement, tenancy, de-identified analytics, access governance and assurance. It is built for the organisation that publishes assessments, not only for the person sitting one.
Row-level security on every tenant table forced on the application role, candidates restricted to their own rows by a restrictive policy, clinical results gated behind a clinical role, and an aggregate results view where the role cannot resolve individuals. Response payloads and clinical results are additionally field-encrypted.
Honesty about calibration state. Scaffold items are structurally valid and runnable — scale-mapped, keyed, reverse-flagged, carrying seeded IRT parameters — but they are not calibrated against a norm sample. The workflow moves items scaffold, authored, reviewed, calibrated, and an instrument is not cleared for a real decision until it is through.
Yes. Each tenant is pinned to exactly one of seven regions, including AU-Southeast, and there is no cross-region processing. The region is a property of the tenant, set when it is created.
A break-glass account can be created against one named client site, with the functions chosen one by one. It is out-of-band by design, requires approval, and every action it takes is written to the hash-chained activity trail with alerting on the event.
The rest of the product range
Bring us your catalogue
We will stand up a private tenant with a sample of your instruments loaded, walk your risk team through the security posture, and show your commercial team what entitlement enforcement does to leakage.