Your data is safe

Submissions, results and proctoring recordings are hosted in France, at Scaleway and in the AWS eu-west-3 (Paris) region. Nothing is replicated outside Europe, backups included. A handful of peripheral technical services may involve a transfer covered by contractual safeguards, listed below.

We use no US and no Asian region for exam data.

A useful clarification: the ISO/IEC 27001 certification mentioned above is Scaleway's, our hosting provider. It covers their data centres and their processes, not the Evalmee software. Evalmee itself is not ISO 27001 certified — see the “What certifications does Evalmee hold?” section.

In transit, all traffic runs over HTTPS with TLS 1.2 or TLS 1.3. At rest, sensitive data is encrypted with AES-256 and passwords are hashed. This is exactly the measure that article 6 of the CNIL recommendation expects of a remote proctoring system.

In detail:

• In transit: HTTPS (TLS 1.2 / TLS 1.3) across all traffic, without exception
• At rest: AES-256 encryption for sensitive data, hashing for passwords
• Encrypted backups, kept in the same geographic zone as production data

Our infrastructure applies defence in depth: upstream DDoS protection, a partitioned private network, key-based server access, vulnerability monitoring and access logging. None of these measures is enough on its own; it is the way they stack up that shrinks the attack surface.

In practice:

• All services run behind Cloudflare (built-in DDoS protection, rate limiting)
• Virtual private cloud (VPC) with a firewall controlling inbound and outbound traffic
• Server access limited to authorised team members, by SSH key (no passwords)
• Logging of access to dataAudit trailA timestamped log of every event in a session: sign-in, display of each question, successive answers, network incidents, invigilator actions. It is what makes it possible to reconstruct a contested exam and to answer a complaint with something other than memory.See the full definition, in line with the CNIL recommendation on logging (délibération n° 2021-122 du 14 octobre 2021 — CNIL recommendation no. 2021-122 of 14 October 2021)
• Automated monitoring of vulnerabilities in software components (CVE)
• Team trained on OWASP Top 10 vulnerabilities (regular code and infrastructure audits)

On 8 June 2023 the CNIL adopted délibération n° 2023-058 (CNIL recommendation no. 2023-058 of 8 June 2023), published in Journal officiel no. 0203 of 2 September 2023 (text no. 63). It does not ban remote proctoring: it requires that proctoring be proportionate to what is genuinely at stake in the exam, and describes the arrangements it considers acceptable. It is the reference text in France.

The recommendation covers “any type of examination or certification, organised by a public institution or a private body”. It also restates something we cannot do in your place: the institution running the exam is the data controller, Evalmee is only its processor. Our job is to provide settings that let you stay inside that framework.

Read délibération n° 2023-058 on cnil.fr →

The paragraphs cited follow the numbering of the recommendation published by the CNIL. This reading is our own and does not bind the CNIL: as the data controller, it falls to you to carry out your own analysis, with your data protection officer, and where relevant the impact assessmentAnalyse d'impact (AIPD, French data protection impact assessment)Analyse d'impact relative à la protection des données: according to the CNIL, a tool for building a processing operation that complies with the GDPR and respects privacy. It is required for processing operations likely to result in a high risk to the rights and freedoms of the people concerned.See the full definition provided for in § 32.

Not in the standard product — the Mini, Pro and Max plans: identity verification there is a comparison of documents, checked by eye by the examiner, who decides personally — the first arrangement the CNIL names in § 43 of its recommendation. On the Organisation plan, automated identity validation can be deployed on a quote basis: it is limited to establishing the candidate's identity, before the exam or afterwards as an option, and is never used to monitor them during the exam.

On a subject where many vendors stay vague, here is exactly what happens:

• The participant photographs their ID document or student card through the webcam, along with one or more reference photos of their face.
• The examiner compares the two visually, and decides: in the standard product, no AI validates the document in their place, and the validation is human from end to end.
• In the standard product, no biometric template is computed or stored. The CNIL recommendation explicitly rules out building such databases at remote proctoringRemote proctoringThe set of arrangements that make it possible to supervise a candidate sitting outside an exam centre: video and audio capture, screen monitoring, detection of atypical behaviour. The level chosen must stay proportionate to the stakes of the exam and to the data it leads you to collect.See the full definition providers (§ 46).
• No automated analysis of behaviourAutomated proctoringSupervision carried out by algorithms that analyse the video feed, the sound and the activity on the device in order to flag atypical events: face absent, second person present, window switched. The flags produced are leads to be investigated, never proof of cheating in themselves. The automation lies in the analysis, never in the decision: drawing a consequence from a flag without a person having examined it would be a fully automated decision, governed by article 22 of the GDPR.See the full definition: no gaze direction, no emotion detection, no keystroke dynamics. The CNIL recommends against using them (§ 37); we do not offer them.
• The only automated signals concern activity inside the exam — leaving full screen, switching to another application — that is, what the CNIL places among the proportionate arrangements for enhanced monitoring (§ 35).

One caveat, and we would rather write it down than keep quiet about it: on the Organisation plan, automated identity validationCandidate authenticationVerification that the person sitting the exam is the person enrolled: named credentials, sign-in through the institution's directory, checking an identity document, sometimes a biometric comparison. The level of verification is set by the stakes of the exam and by the data it makes it legitimate to process.See the full definition can be deployed on a quote basis. It is limited to establishing the candidate's identity — before the exam, or afterwards as an option — and is never used to monitor them during the exam. It is never enabled without an explicit decision by the institution, and remains subject to the cumulative conditions of § 45 — a single verification, a very large number of candidates, an alternative always available, and candidates informed beforehand.

Image and audio data from remote proctoring is deleted by default after three months, the time needed to handle appeals. Submissions, answers and marks follow the period you set: you are the data controller, and Evalmee keeps nothing on its own initiative.

• Remote proctoring (webcam, microphone, screen captures): deleted by default after three months.
• Organisation plan: a different period can be set contractually, never exceeding twelve months.
• Submissions, answers, marks, metadata: the periodData retention periodThe length of time personal data may remain in an active database. The CNIL points out that it is determined by the purpose of the processing: at the end of that period the data must be deleted, anonymised or archived, which bears directly on remote proctoring recordings.See the full definition is set by the examining institution.
• Access restricted to examiners within the client organisation, with optional logging of who consults what.
• Downloading, distribution or external reuse prohibited, save for a legal obligation or a formal request from the authorities.

Evalmee uses OpenAI models to speed up authoring and grading. No personally identifiable data is sent to them, no customer data is used to train a model, and AI-assisted grading of an open question remains subject to validation by a human grader.

Our commitments:

• No personally identifiable customer data is sent to OpenAI or to any other third-party AI provider
• Your data is never used to train AI models
• AI calls are limited to non-personal content (question text, MCQ structure)
• AI-assisted gradingAI-assisted markingPre-marking of written answers by a language model, which proposes a mark and a justification that the marker validates, amends or rejects. The decision stays human: what the AI saves is the first pass over the paper, never the responsibility for the mark.See the full definition of open questions is always validated by a grader: no mark is ever awarded automatically on a written answer

The full list is public and kept up to date. It names every provider, its purpose and its country of establishment, as article 28 of the GDPR requires. We only share your data with the partners strictly necessary to deliver the service.

A public list is worth more than a general promise: your data protection officer can read it without having to ask us for it, and check for themselves that no biometric verification provider appears on it. View the full list of our sub-processors

Yes. We provide a Data Processing Agreement compliant with article 28 of the GDPR: respective responsibilities, retention periods, security measures and sub-processors. It is signed before go-live, at no extra cost, whatever your plan.

The DPA is the document your data protection officer will ask for. We would rather it were on the table from the evaluation stage than on the eve of signature.

For a signed copy, contact us.

Evalmee is built so that your institution can process exam data in line with the GDPR: minimisation, hosting in France, data subject rights, breach notification. Compliance is judged processing by processing, however, and you are the one accountable for it.

Our commitments as a processor:

• Process only the data strictly necessaryData minimisationThe GDPR principle under which, in the CNIL's wording, personal data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. Applied to remote proctoring, it requires collecting only what the stakes of the exam justify.See the full definition to deliver the service
• Guarantee your rights of access, rectification, portability and deletion
• Keep exam data in France, and cover the rare transfers tied to peripheral tools with standard contractual clauses
• Notify you without delay in the event of a data breach, so that you can meet the 72-hour deadline of article 33 of the GDPR
• Guarantee the student access to the data collected during remote proctoring, which the CNIL requires in all circumstances (§ 16)

To exercise your rights or for any question regarding your data, contact us.

Data protection questions have a single point of contact, monitored by our team: contact@evalmee.com.

None, to date, in its own name. We would rather write that plainly than borrow somebody else's: the certifications cited on this page are those of our hosting providers and cover their scope, not ours.

If one of these standards is a condition of your purchase, tell us in the first conversation. We would rather flag it early than let you find out at the end of the process.

As of 14 August 2026, Evalmee's public status page shows 100% observed availability over the last ninety days, for each of its seven components — remote proctoring included. That is a figure observed over a rolling window, not a contractual commitment.

We do not sell an SLA on self-service plans. What we publish is the real state of the services and the incident history, updated automatically. That is the source we invite you to check — it is more useful than a number frozen in a brochure.

See Evalmee's service status →

A contractual availability commitment can be negotiated as part of the Organisation plan. Outside that, no SLA is attached to subscriptions.

The regulatory statements on this page point to the texts below. Each link was checked on the date shown.

1. CNIL — Délibération n° 2023-058 du 8 juin 2023 portant adoption d'une recommandation relative aux modalités de mise en œuvre des dispositifs de télésurveillance pour les examens en ligne (CNIL recommendation no. 2023-058 of 8 June 2023 on remote proctoring arrangements for online exams)

   https://www.cnil.fr/sites/cnil/files/2023-09/recommandation_dispositifs_de_telesurveillance_des_examens.pdf

   Consulted on 14 August 2026

2. CNIL — Remote proctoring of online exams: the CNIL publishes a recommendation

   https://www.cnil.fr/fr/telesurveillance-des-examens-en-ligne-la-cnil-publie-une-recommandation

   Consulted on 14 August 2026

3. Légifrance — Délibération n° 2023-058, text published in Journal officiel no. 0203 of 2 September 2023, text no. 63

   https://www.legifrance.gouv.fr/jorf/id/JORFTEXT000048038547

   Consulted on 14 August 2026

4. Légifrance — Article D. 611-12 of the code de l'éducation (the French Education Code) — validation of coursework through examinations held remotely in digital form

   https://www.legifrance.gouv.fr/codes/article_lc/LEGIARTI000034485782

   Consulted on 14 August 2026

5. French Ministry of Higher Education and Research, DGESIP — Fiche 6 — Évaluer et surveiller à distance (Sheet 6 — Assessing and proctoring remotely), teaching continuity plan

   https://services.dgesip.fr/fichiers/Fiche_6_-_Evaluer_et_surveiller_a_distance.pdf

   Consulted on 14 August 2026

6. EUR-Lex — Regulation (EU) 2016/679 (GDPR), in particular articles 9, 22, 28, 32 and 33

   https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

   Consulted on 14 August 2026

7. Scaleway — Scaleway infrastructure security and resilience

   https://www.scaleway.com/en/security-and-resilience/

   Consulted on 14 August 2026

8. Evalmee — Evalmee privacy policy (processor)

   https://evalmee.notion.site/CHARTE-DE-CONFIDENTIALIT-25902ccf87f54af78b17fc1b30182d56

   Consulted on 14 August 2026

9. Evalmee — List of Evalmee's sub-processors

   https://evalmee.notion.site/LISTE-DES-SOUS-TRAITANTS-D-EVALMEE-SUBPROCESSORS-26a80d73d8c080ec813cd766cd30a9fc?source=copy_link

   Consulted on 14 August 2026

10. Evalmee — Checking and verifying participants' identity — Evalmee help centre

    https://help.evalmee.com/fr/articles/0824750-controler-et-verifier-lidentite-des-participants

    Consulted on 14 August 2026

Is remote exam proctoring GDPR-compliant?

Yes, provided it stays proportionate. The CNIL, France's data protection authority, sets the rules in its délibération no. 2023-058 of 8 June 2023: the setup must be chosen in the light of what is at stake in the exam, automated analysis of candidate behaviour must be ruled out, and the institution — as data controller — must inform candidates in advance.

Does Evalmee use facial recognition?

Not in the standard product — the Mini, Pro and Max plans: identity verification there rests on a comparison of documents, the participant holds their ID up to the webcam, the examiner compares the two visually and then decides, and no biometric template is computed or kept. On the Organisation plan, automated identity verification can be deployed on a quote basis: it is limited to establishing the candidate's identity, before the exam or afterwards as an option, and is never used to monitor them during the exam. The conditions for such a deployment are set out on the security page.

Where is Evalmee's data hosted?

In France, at Scaleway and in the AWS eu-west-3 (Paris) region, backups included. Exam data does not leave French soil. A few peripheral tools — Cloudflare, Sentry, Stripe — may involve a transfer covered by the European Commission's standard contractual clauses.

How long does Evalmee keep proctoring recordings?

Image and audio data from remote proctoring is deleted by default after three months, the time needed to handle appeals. On the Organisation plan, a different period can be set contractually, without ever exceeding twelve months.

Is Evalmee ISO 27001 or SOC 2 certified?

No. Evalmee holds no security certification in its own name today: no SOC 2, no ISO/IEC 27001, no HDS, no SecNumCloud. The ISO/IEC 27001 certification mentioned on our security page is Scaleway's, our hosting provider, and covers their data centres.

Does Evalmee offer a Data Processing Agreement (DPA)?

Yes, at no extra cost and whatever the plan. Our Data Processing Agreement complies with article 28 of the GDPR: it sets out the respective responsibilities, the retention periods, the security measures and the list of sub-processors, which is public in any case.

Does Evalmee guarantee a contractual availability rate?

Not on the self-service plans: no service level commitment is attached to them. Evalmee does, however, publish a status page open to everyone, showing observed availability over the last ninety days along with the incident history. An SLA can be negotiated on the Organisation plan.