Crux trust page
Version 1.0, effective September 16, 2026. One page for the people who review tools before a class uses them: what Crux holds, where, for how long, who else touches it, what the AI does and does not do, which certifications exist and which do not yet, and how to get a document signed. Every line here is backed by a fuller document linked below. Where something is not in place, this page says so.
Crux is operated by Jonathan Cooper, an individual in Kentucky, USA, while a company is being formed. Contact for anything on this page: jon@cruxcall.com. Acknowledgment within two business days.
At a glance
| Item | Status | Detail |
|---|---|---|
| Role under FERPA | School official | Crux holds interview records on the professor's or institution's behalf, uses them only for the course, shares them with no one else, and deletes on instruction. We sign the institution's data agreement. |
| Data location | United States | One virtual machine at Google Cloud, us-central1 (Iowa). Backups on an encrypted disk in Kentucky. AI processing at Anthropic and ElevenLabs, USA. |
| Encryption | In place | TLS 1.2+ in transit with HSTS; encrypted disks at rest (Google Cloud default encryption); encrypted backup disk. |
| Retention | Published | Interview records until the professor deletes them or the end of the following academic term; logs 30 days; backups 14 days. Full schedule in Retention and Deletion. |
| Model training | Never | No Crux data trains any model. Anthropic's commercial terms prohibit training on API content. ElevenLabs processing runs under its commercial terms with training excluded for Crux's account. |
| Biometrics | None, by commitment | No voiceprints, no face templates, no speaker identification, now or in a future version without a new consent and a new notice. |
| Proctoring and surveillance | None | No lockdown browser, no webcam analysis, no tab tracking, no eye tracking. Integrity comes from the evidence, not monitoring. |
| AI grading | None | The AI assembles evidence and checks numbers. The professor assigns every grade. Students never see a score from Crux. |
| Delivery scoring | None | Accent, pace, filler words, tone and "confidence" are not evaluated. Only the content of what was said. |
| Student identity | Roster or typed name | Students pick their name from the Canvas roster when the professor has linked one, otherwise type it. No student accounts or passwords. |
| Accessibility | Accommodations in the product; conformance report planned | Extended time (1.5x, 2x), typed answers, text-only interviewer, larger text, higher contrast, pause at any time, live captions where the browser supports them. A WCAG 2.1 AA self-assessment (VPAT) is planned before institutional use. |
| Data processing agreement | On request | We sign the institution's DPA or state student-privacy agreement, or provide ours. |
| HECVAT | On request | We complete HECVAT Lite for any institution that asks; full HECVAT before an institutional contract. |
| SOC 2 | Not yet | No report. Readiness work begins with the first institutional agreement; a Type I report is the target within twelve months of that. |
| Penetration test | Not yet | None by a third party. Planned alongside SOC 2 readiness. |
| Single sign-on | Not yet | Professors use per-professor passcodes; students need no account. Institutional sign-in (Canvas LTI 1.3) is the next integration on the roadmap. |
| LMS integration | Canvas, phase 1 | Roster import and grade posting through a professor's own Canvas access token. LTI 1.3 with roster and grade services is in build. |
| Breach notification | 72 hours | To the affected professor or institution without undue delay and within 72 hours of confirmation; students through them. |
| Sub-processor changes | 30 days' notice | By email to professors with active assignments. |
| Students under 13 | Not permitted | Crux is used with adult graduate students. Use with students under 18 requires the school to handle parental notice and consent first. |
What Crux holds
For each interview: the student's name as entered, the audio clip and verbatim transcript of each answer, typed text and scratch-pad notes if used, the written work the student uploaded, the interviewer's questions and private notes, the evidence map, the numbers check, the suggested band and written feedback, the professor's grade and comments, the consent record (notice version, time, network address), response-time measurements, and accommodation choices. For each professor: name, passcode, assignments, rubrics, answer keys, settings and personas.
Not held: student accounts or passwords, payment information, advertising or analytics identifiers, cookies, biometric identifiers, video (not in the current version).
Full list and purposes: Privacy Notice.
Who else touches it
| Sub-processor | Receives | Purpose | Training | Retention at the vendor |
|---|---|---|---|---|
| Anthropic (Claude API) | Case, rubric, uploaded work, transcripts, typed text | Interviewer and evaluator | Prohibited by Anthropic's commercial terms | Anthropic's published API policy: inputs and outputs held for abuse monitoring, then deleted |
| ElevenLabs (API) | Text of each question; each recorded answer | Interviewer's voice; verbatim transcription | Excluded for Crux's account | Processing only; nothing is stored for Crux beyond the request |
| Google Cloud | Everything Crux stores | Hosting, us-central1 | Not applicable (infrastructure) | While Crux stores it |
| Cloudflare | Domain, DNS, email routing to jon@cruxcall.com | Infrastructure | Not applicable | Not applicable; no content is proxied or cached |
Changes to this list are posted here and emailed to professors with active assignments 30 days ahead.
What the AI does, and does not
Does: drafts the interview plan from the professor's case and rubric (every question editable); reads the student's uploaded work and plans questions about the student's own claims and numbers; conducts the interview one question at a time with follow-ups on what was actually said; recomputes every number the student states against the case and the professor's answer key using a deterministic calculator; maps the transcript to the rubric with quotes and timestamps; suggests a band with reasoning for the professor; writes feedback to the student.
Does not: assign grades; identify people; detect cheating; evaluate accent, pace, tone or confidence; reveal answers or confirm numbers during a graded interview; learn from students.
Known limits, stated: transcription errors, especially with numbers (the audio clip is the record and doubtful transcriptions are flagged); lower transcription accuracy for some speakers, not yet measured on Crux's own interviews (the typed-answer accommodation exists for this reason among others); judgment calls the professor can overrule; occasional persona drift; pacing enforced by rules rather than perfect.
Students are told before they begin that an AI conducts the interview, that it is recorded and transcribed, and that their professor decides the grade. Full statement: AI Use Statement.
Security in brief
One Node.js application on one virtual machine behind a reverse proxy that terminates HTTPS with automatically renewed certificates. Data stored as files on an encrypted disk. Secrets readable only by the service user, never in source control or the interface. Professors see only their own assignments and interviews, enforced on the server for every request. Server access by SSH key only, password login disabled, host firewall open only for SSH, HTTP and HTTPS. Rate limits on interviews and speech synthesis. Request and error logs kept 30 days, without transcript content. Nightly backups, 14 days. Rebuild from a scripted setup in under an hour. Search engines told not to index.
Not yet in place, said plainly: SOC 2, third-party penetration test, single sign-on, redundancy beyond one machine and one region, formal on-call. Full description: Security Overview.
Student rights
Any student can ask to see, correct or delete the data Crux holds about them: from the result page, or by email to jon@cruxcall.com with the interview date and the name used. Acknowledgment within five business days, full response within 30 days. If a grade has been recorded, the professor may keep the grade and their notes; the recording, transcript and evaluation are deleted. Students can contest an evaluation with their professor, who can replay the recording. Interviews in an academic-integrity or appeals process are held from purges until released.
Documents available on request
Data processing agreement (the institution's or ours), state student-privacy agreements, HECVAT Lite, a completed security questionnaire, the sub-processor list with contract terms, a description of the deletion procedure, and the Pilot Memorandum (PDF) for a single-professor pilot. Write to jon@cruxcall.com.
Roadmap for this page
In order: WCAG 2.1 AA self-assessment (VPAT) · measured transcription accuracy across speaker groups, published · Canvas LTI 1.3 with institutional sign-in · legal entity formed and named here · SOC 2 readiness and Type I report · third-party penetration test. Each item moves from "planned" to "in place" on this page with a dated change note.
Changes
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-09-16 | First publication. |
All Crux policies: Legal and Policies.