# Security, GDPR and the CNIL recommendation | Evalmee > Hosting in France, encryption, GDPR compliance and alignment with CNIL délibération no. 2023-058 on the remote proctoring of online exams. No facial recognition in the standard product. Source: https://evalmee.com/en/security/ FR: https://evalmee.com/fr/securite/ ES: https://evalmee.com/es/seguridad/ ES-ES: https://evalmee.com/es-es/seguridad/ IT: https://evalmee.com/it/sicurezza/ --- ## Your data is safe Evalmee is hosted in France, GDPR-compliant, and aligned with the recommendation of the CNIL — France's data protection authority — on the remote proctoring of online exams. ## Where is Evalmee's data hosted? Submissions, results and proctoring recordings are hosted in France, at Scaleway and in the AWS eu-west-3 (Paris) region. Nothing is replicated outside Europe, backups included. A handful of peripheral technical services may involve a transfer covered by contractual safeguards, listed below. We use no US and no Asian region for exam data. - [Scaleway](https://www.scaleway.com/en/security-and-resilience/) — French hosting provider, ISO/IEC 27001 certified for its data centres - [AWS France](https://aws.amazon.com/compliance/eu-data-protection/) — eu-west-3 region (Paris), data at rest within the European Union Let us be precise rather than reassuring. Exam data does not leave France. Three peripheral tools — Cloudflare (network protection), Sentry (error reporting) and Stripe (payments) — are established in the EU but belong to US groups: where a transfer is involved, it is covered by the European Commission's standard contractual clauses, as article 5 of the CNIL recommendation points out. Our public list of sub-processors states the country of establishment for each of them. Where each of the six other French platforms declares it hosts its data is set out, source by source, in the [comparison of online exam platforms](https://evalmee.com/en/online-exam-platform-comparison/). A useful clarification: the ISO/IEC 27001 certification mentioned above is Scaleway's, our hosting provider. It covers their data centres and their processes, not the Evalmee software. Evalmee itself is not ISO 27001 certified — see the “What certifications does Evalmee hold?” section. ## How is data encrypted? In transit, all traffic runs over HTTPS with TLS 1.2 or TLS 1.3. At rest, sensitive data is encrypted with AES-256 and passwords are hashed. This is exactly the measure that article 6 of the CNIL recommendation expects of a remote proctoring system. In detail: - In transit: HTTPS (TLS 1.2 / TLS 1.3) across all traffic, without exception - At rest: AES-256 encryption for sensitive data, hashing for passwords - Encrypted backups, kept in the same geographic zone as production data ## How is the infrastructure protected? Our infrastructure applies defence in depth: upstream DDoS protection, a partitioned private network, key-based server access, vulnerability monitoring and access logging. None of these measures is enough on its own; it is the way they stack up that shrinks the attack surface. In practice: - All services run behind Cloudflare (built-in DDoS protection, rate limiting) - Virtual private cloud (VPC) with a firewall controlling inbound and outbound traffic - Server access limited to authorised team members, by SSH key (no passwords) - [Logging of access to data](https://evalmee.com/en/assessment-glossary/#audit-trail), in line with the CNIL recommendation on logging (délibération n° 2021-122 du 14 octobre 2021 — CNIL recommendation no. 2021-122 of 14 October 2021) - Automated monitoring of vulnerabilities in software components (CVE) - Team trained on OWASP Top 10 vulnerabilities (regular code and infrastructure audits) ## What does the CNIL say about the remote proctoring of online exams? **What the CNIL recommends, and how Evalmee complies** | CNIL recommendation | Ref. | What Evalmee does | | --- | --- | --- | | Keep the system proportionate to what is at stake in the exam, and do without remote proctoring when the stakes are low | § 33-34 | Every mechanism — full screen, screen-exit alert, screen recording, video monitoring, identity verification — is set exam by exam. Nothing is enabled by default, and Evalmee never turns these options on of its own accord. | | Monitor the candidate's activity through the platform, by detecting or blocking access to other tabs | § 35 | Mandatory full screen, and an alert each time the candidate leaves the exam screen. Screen captures are triggered by an event — leaving full screen, switching to another application, a suspicious browser extension — and not by a continuous video stream of the screen. | | Rule out any automated analysis of candidate behaviour: typing rate, gaze direction, emotions | § 36-37 | Evalmee analyses neither gaze direction, nor emotions, nor keystroke dynamics. None of these technologies exists in the product, not even as an option. | | Never let an automated system decide on its own: a human check must come before any decision | § 38 | An alert opens a passage to review, never a sanction. The decision belongs to the proctor or to the examining board, live through the built-in chat or afterwards on the submission's timeline. | | Favour document comparison to verify identity, and place strict limits on any biometric processing | § 43-47 | In the standard product, Evalmee's identity verification is a visual comparison of documents, settled by the examiner, and no biometric template is computed or stored. On the Organisation plan, an automated identity check can be deployed on quote, under the conditions of § 45. | | Set retention periods before going live, and keep them short | § 48-49 | Image and audio data from remote proctoring is deleted by default after three months, the time needed to handle appeals. A different period can be set contractually on the Organisation plan, without ever exceeding twelve months. | | Encrypt data in transit and at rest, restrict read access and keep logs | § 53-56 | TLS 1.2/1.3 in transit, AES-256 at rest. Recordings are accessible only to examiners within the client organisation; Evalmee never accesses them, except where strictly necessary for technical reasons and under confidentiality controls. | | Place safeguards around transfers of data outside the European Union | § 51 | Exam data stays in France. The rare transfers tied to peripheral tools are covered by the standard contractual clauses. | On 8 June 2023 the CNIL adopted délibération n° 2023-058 (CNIL recommendation no. 2023-058 of 8 June 2023), published in Journal officiel no. 0203 of 2 September 2023 (text no. 63). It does not ban remote proctoring: it requires that proctoring be proportionate to what is genuinely at stake in the exam, and describes the arrangements it considers acceptable. It is the reference text in France. The recommendation covers “any type of examination or certification, organised by a public institution or a private body”. It also restates something we cannot do in your place: the institution running the exam is the data controller, Evalmee is only its processor. Our job is to provide settings that let you stay inside that framework. ### The proportionality principle, in two sentences The CNIL asks that “the analysis of the effectiveness and proportionality of an exam proctoring system [be carried out] as a whole and not measure by measure” (§ 33), and that the choice of tools “be assessed in the light of the context and of what is at stake in the exam” (§ 34). Enhanced monitoring is appropriate for a competitive entrance exam; a mock exam, on the other hand, “should be run without remote proctoring”. The paragraphs cited follow the numbering of the recommendation published by the CNIL. This reading is our own and does not bind the CNIL: as the data controller, it falls to you to carry out your own analysis, with your data protection officer, and where relevant the [impact assessment](https://evalmee.com/en/assessment-glossary/#analyse-d-impact-aipd-french-data-protection-impact-assessment) provided for in § 32. [Read délibération n° 2023-058 on cnil.fr](https://www.cnil.fr/sites/cnil/files/2023-09/recommandation_dispositifs_de_telesurveillance_des_examens.pdf) ## Does Evalmee use facial recognition? Not in the standard product — the Mini, Pro and Max plans: identity verification there is a comparison of documents, checked by eye by the examiner, who decides personally — the first arrangement the CNIL names in § 43 of its recommendation. On the Organisation plan, automated identity validation can be deployed on a quote basis: it is limited to establishing the candidate's identity, before the exam or afterwards as an option, and is never used to monitor them during the exam. On a subject where many vendors stay vague, here is exactly what happens: - The participant photographs their ID document or student card through the webcam, along with one or more reference photos of their face. - The examiner compares the two visually, and decides: in the standard product, no AI validates the document in their place, and the validation is human from end to end. - In the standard product, no biometric template is computed or stored. The CNIL recommendation explicitly rules out building such databases at [remote proctoring](https://evalmee.com/en/assessment-glossary/#remote-proctoring) providers (§ 46). - No [automated analysis of behaviour](https://evalmee.com/en/assessment-glossary/#automated-proctoring): no gaze direction, no emotion detection, no keystroke dynamics. The CNIL recommends against using them (§ 37); we do not offer them. - The only automated signals concern activity inside the exam — leaving full screen, switching to another application — that is, what the CNIL places among the proportionate arrangements for enhanced monitoring (§ 35). One caveat, and we would rather write it down than keep quiet about it: on the Organisation plan, [automated identity validation](https://evalmee.com/en/assessment-glossary/#candidate-authentication) can be deployed on a quote basis. It is limited to establishing the candidate's identity — before the exam, or afterwards as an option — and is never used to monitor them during the exam. It is never enabled without an explicit decision by the institution, and remains subject to the cumulative conditions of § 45 — a single verification, a very large number of candidates, an alternative always available, and candidates informed beforehand. ## How long are recordings kept? Image and audio data from remote proctoring is deleted by default after three months, the time needed to handle appeals. Submissions, answers and marks follow the period you set: you are the data controller, and Evalmee keeps nothing on its own initiative. - Remote proctoring (webcam, microphone, screen captures): deleted by default after three months. - Organisation plan: a different period can be set contractually, never exceeding twelve months. - Submissions, answers, marks, metadata: [the period](https://evalmee.com/en/assessment-glossary/#data-retention-period) is set by the examining institution. - Access restricted to examiners within the client organisation, with optional logging of who consults what. - Downloading, distribution or external reuse prohibited, save for a legal obligation or a formal request from the authorities. ## What is Evalmee's AI policy? Evalmee uses OpenAI models to speed up authoring and grading. No personally identifiable data is sent to them, no customer data is used to train a model, and AI-assisted grading of an open question remains subject to validation by a human grader. Our commitments: - No personally identifiable customer data is sent to OpenAI or to any other third-party AI provider - Your data is never used to train AI models - AI calls are limited to non-personal content (question text, MCQ structure) - [AI-assisted grading](https://evalmee.com/en/assessment-glossary/#ai-assisted-marking) of open questions is always validated by a grader: no mark is ever awarded automatically on a written answer ## Who are Evalmee's sub-processors? The full list is public and kept up to date. It names every provider, its purpose and its country of establishment, as article 28 of the GDPR requires. We only share your data with the partners strictly necessary to deliver the service. A public list is worth more than a general promise: your data protection officer can read it without having to ask us for it, and check for themselves that no biometric verification provider appears on it. [View the full list of our sub-processors](https://evalmee.notion.site/LISTE-DES-SOUS-TRAITANTS-D-EVALMEE-SUBPROCESSORS-26a80d73d8c080ec813cd766cd30a9fc?source=copy_link) ## Does Evalmee offer a Data Processing Agreement (DPA)? Yes. We provide a Data Processing Agreement compliant with article 28 of the GDPR: respective responsibilities, retention periods, security measures and sub-processors. It is signed before go-live, at no extra cost, whatever your plan. The DPA is the document your data protection officer will ask for. We would rather it were on the table from the evaluation stage than on the eve of signature. ## Is Evalmee GDPR-compliant? Evalmee is built so that your institution can process exam data in line with the GDPR: minimisation, hosting in France, data subject rights, breach notification. Compliance is judged processing by processing, however, and you are the one accountable for it. Our commitments as a processor: - Process only the [data strictly necessary](https://evalmee.com/en/assessment-glossary/#data-minimisation) to deliver the service - Guarantee your rights of access, rectification, portability and deletion - Keep exam data in France, and cover the rare transfers tied to peripheral tools with standard contractual clauses - Notify you without delay in the event of a data breach, so that you can meet the 72-hour deadline of article 33 of the GDPR - Guarantee the student access to the data collected during remote proctoring, which the CNIL requires in all circumstances (§ 16) Data protection questions have a single point of contact, monitored by our team: contact@evalmee.com ## What certifications does Evalmee hold? None, to date, in its own name. We would rather write that plainly than borrow somebody else's: the certifications cited on this page are those of our hosting providers and cover their scope, not ours. - Exam data hosted in France, at Scaleway and AWS (eu-west-3 region) - TLS 1.2 / 1.3 encryption in transit, AES-256 at rest - Data Processing Agreement compliant with article 28 of the GDPR, provided on request - Public, dated list of sub-processors - Service status page open to everyone - SOC 2, Type I or Type II: Evalmee is not SOC 2 audited - ISO/IEC 27001: the certification cited on this page is Scaleway's, our hosting provider, and not Evalmee's - HDS (French health data hosting): Evalmee is not HDS certified and is not intended to process health data - SecNumCloud: Evalmee does not hold the ANSSI SecNumCloud qualification If one of these standards is a condition of your purchase, tell us in the first conversation. We would rather flag it early than let you find out at the end of the process. ## How available is the service? As of 14 August 2026, Evalmee's public status page shows 100% observed availability over the last ninety days, for each of its seven components — remote proctoring included. That is a figure observed over a rolling window, not a contractual commitment. We do not sell an SLA on self-service plans. What we publish is the real state of the services and the incident history, updated automatically. That is the source we invite you to check — it is more useful than a number frozen in a brochure. A contractual availability commitment can be negotiated as part of the Organisation plan. Outside that, no SLA is attached to subscriptions. [See Evalmee's service status](https://evalmee.statuspage.io/) ## Sources and reference texts The regulatory statements on this page point to the texts below. Each link was checked on the date shown. - [Délibération n° 2023-058 du 8 juin 2023 portant adoption d'une recommandation relative aux modalités de mise en œuvre des dispositifs de télésurveillance pour les examens en ligne (CNIL recommendation no. 2023-058 of 8 June 2023 on remote proctoring arrangements for online exams)](https://www.cnil.fr/sites/cnil/files/2023-09/recommandation_dispositifs_de_telesurveillance_des_examens.pdf) — CNIL (14 August 2026) - [Remote proctoring of online exams: the CNIL publishes a recommendation](https://www.cnil.fr/fr/telesurveillance-des-examens-en-ligne-la-cnil-publie-une-recommandation) — CNIL (14 August 2026) - [Délibération n° 2023-058, text published in Journal officiel no. 0203 of 2 September 2023, text no. 63](https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000048038547) — Légifrance (14 August 2026) - [Article D. 611-12 of the code de l'éducation (the French Education Code) — validation of coursework through examinations held remotely in digital form](https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000034485782) — Légifrance (14 August 2026) - [Fiche 6 — Évaluer et surveiller à distance (Sheet 6 — Assessing and proctoring remotely), teaching continuity plan](https://services.dgesip.fr/fichiers/Fiche_6_-_Evaluer_et_surveiller_a_distance.pdf) — French Ministry of Higher Education and Research, DGESIP (14 August 2026) - [Regulation (EU) 2016/679 (GDPR), in particular articles 9, 22, 28, 32 and 33](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679) — EUR-Lex (14 August 2026) - [Scaleway infrastructure security and resilience](https://www.scaleway.com/en/security-and-resilience/) — Scaleway (14 August 2026) - [Evalmee privacy policy (processor)](https://evalmee.notion.site/CHARTE-DE-CONFIDENTIALIT-25902ccf87f54af78b17fc1b30182d56) — Evalmee (14 August 2026) - [List of Evalmee's sub-processors](https://evalmee.notion.site/LISTE-DES-SOUS-TRAITANTS-D-EVALMEE-SUBPROCESSORS-26a80d73d8c080ec813cd766cd30a9fc?source=copy_link) — Evalmee (14 August 2026) - [Checking and verifying participants' identity — Evalmee help centre](https://help.evalmee.com/fr/articles/0824750-controler-et-verifier-lidentite-des-participants) — Evalmee (14 August 2026) ## Frequently asked questions about security and GDPR ### Is remote exam proctoring GDPR-compliant? Yes, provided it stays proportionate. The CNIL, France's data protection authority, sets the rules in its délibération no. 2023-058 of 8 June 2023: the setup must be chosen in the light of what is at stake in the exam, automated analysis of candidate behaviour must be ruled out, and the institution — as data controller — must inform candidates in advance. ### Does Evalmee use facial recognition? Not in the standard product — the Mini, Pro and Max plans: identity verification there rests on a comparison of documents, the participant holds their ID up to the webcam, the examiner compares the two visually and then decides, and no biometric template is computed or kept. On the Organisation plan, automated identity verification can be deployed on a quote basis: it is limited to establishing the candidate's identity, before the exam or afterwards as an option, and is never used to monitor them during the exam. The conditions for such a deployment are set out on the security page. ### Where is Evalmee's data hosted? In France, at Scaleway and in the AWS eu-west-3 (Paris) region, backups included. Exam data does not leave French soil. A few peripheral tools — Cloudflare, Sentry, Stripe — may involve a transfer covered by the European Commission's standard contractual clauses. ### How long does Evalmee keep proctoring recordings? Image and audio data from remote proctoring is deleted by default after three months, the time needed to handle appeals. On the Organisation plan, a different period can be set contractually, without ever exceeding twelve months. ### Is Evalmee ISO 27001 or SOC 2 certified? No. Evalmee holds no security certification in its own name today: no SOC 2, no ISO/IEC 27001, no HDS, no SecNumCloud. The ISO/IEC 27001 certification mentioned on our security page is Scaleway's, our hosting provider, and covers their data centres. ### Does Evalmee offer a Data Processing Agreement (DPA)? Yes, at no extra cost and whatever the plan. Our Data Processing Agreement complies with article 28 of the GDPR: it sets out the respective responsibilities, the retention periods, the security measures and the list of sub-processors, which is public in any case. ### Does Evalmee guarantee a contractual availability rate? Not on the self-service plans: no service level commitment is attached to them. Evalmee does, however, publish a status page open to everyone, showing observed availability over the last ninety days along with the incident history. An SLA can be negotiated on the Organisation plan. ## A question about security? Our team will get back to you quickly. For data protection questions, write directly to contact@evalmee.com.