Links
| Website: https://proctorio.com | Documentation: https://proctorio.com/about | Support: https://proctorio.com/support |
| Scottsdale, AZ | Release Notes: https://changes.proctorio.com/ |  https://twitter.com/proctorio  https://www.linkedin.com/company/proctorio/mycompany/ |
| Sales Contact: sales@proctorio.com |
About
Securing exam integrity is essential to protecting the reputation of your institution and the success of your test takers.
Proctorio’s online proctoring, identity verification, plagiarism detection tools, and content protection tools make up the digital tool box within your assessment platform to ensure your online assessment’s integrity.
Accessibility
At Proctorio, our mission is to ensure high-quality, high-integrity outcomes for online learners, as they pursue their goals of attaining a better education. We believe that everyone deserves the opportunity to pursue a high-quality education, which is why we developed a privacy-centric, accessible, and scalable remote proctoring solution that allows test takers to take exams from home.
Security
| HECVAT status | Completed. Updated Nov, 2021 |
| Data encryption | Proctorio encrypts all collected exam recordings and images in three layers in transit and at rest: 1. The End-to-End Encryption layer is secured using AES-256. 2. Transmission into the data center is TLS 1.2 or 1.3 with PFS (perfect forward secrecy). 3. Data at rest is encrypted with FIPS 140-2 data center compliance. All data centers are ISO 27001 certified, SOC 2 attested. |
| Countries of data storage | Data is stored through the cloud with Microsoft Azure. The locations at which the data is stored is dependent on the region the client is in: USA (California, Texas, Illinois, and Virginia) Canada (Quebec, Toronto) EU (Netherlands, Germany). |
| Data storage method | Cloud storage exclusively through Microsoft Azure. |
| Data retention policy | Proctorio retains data only as directed by an institution related to the services and products that we provide to them. Our contract with partnering organizations establishes a data access policy and retention window that is entirely customizable to the organization's specific desires. When storage devices are decommissioned, they are consistent with NIST 800-88 standards. |
| Incident management program, policy, and testing | Yes, Proctorio has an internal incident response plan. Should a security incident occur, automatic notifications are pushed via email to affected customers immediately, along with phone notification from an institution's Partner Success Manager. Information provided will include scope, impact, and time to correction if a patch has not already been released. More information can be found in our HECVAT. |
| Disaster recovery and business continuity plan and testing | Proctorio's disaster recovery and backup process begins with operational redundancy. Redundancy exists through seamless load balancing across a network of four data centers and begins with DNS. Proctorio uses multiple DNS providers with automatic failover. In the event of network failure, it takes a maximum of 30 seconds for the system to autocorrect. Within each data center, exam data is copied and distributed 8 times and accounts for physical metrics including network connection, power, and cooling. |
| Security Standard Certificates | ISO 27011 certified, SOC 2 Type 2 Compliant |
| Third party testing and security controls practices | Proctorio employs daily penetration testing to ensure continued system security and performance, as well as monthly vulnerability scans in accordance with company security requirements using both internal and external resources. |
Privacy
| Privacy policy link | https://proctorio.com/privacy |
| COPPA policy link | https://proctorio.com/privacy/compliance |
| Privacy department/officer contact: | Pamela Fetterolf, Director of Compliance / pamela@proctorio.com |
| Types of data collected | internet connectivity, computer performance |
| Personally identifiable or personal data collected | We do not require personally identifiable information to use Proctorio. Proctorio encrypts exam audio, video, and screen recordings and images with end-to-end encryption. This means that once these images and recordings are encrypted, they can only be decrypted by Institution-approved representatives. Proctorio may have access to some of this information (if the Institution chooses to collect it) when providing live technical support to an exam taker during the exam. With the Live Proctoring Services, Proctorio proctors are able to review exam sessions (including this recorded information, if the Institution chooses to collect it) in real time. With Professional Review Services, the Institution gives authorized Proctorio staff members temporary access to review exam sessions (if the Institution chooses to collect it), typically within 48 hours after the exam session. |
| Data Deletion Request Process | end-users can request record deletion through their institution. |
| Third Party Data Sharing & Opt-out | Proctorio does not sell your Personal Information. Proctorio does not and will not sell or otherwise transfer student information to any third party except as specifically stated in Proctorio’s Terms. Test-taker Personal Information maintained in the Institution’s exam platform is the property of the Institution. Test-taker audio, video, and screen recordings and images stored within the Proctorio servers are pseudoanonymized and encrypted and will not be sold or transferred to a third party if Proctorio is involved in an acquisition, merger or other corporate reorganization transaction. In such instances, and consistent with and limited to data protection laws and privacy commitments, marketing analytics data, CRM data, customer lists, and other pseudoanonymized data may be disclosed or transferred as part of a corporate reorganization transaction; provided that the acquirer commits to using the information in a manner consistent with applicable law and this Privacy Policy. |
| Cookies or Tracking Technologies used | Proctorio manages sessions without using cookies (or HTML Web Storage) and runs cookie-free domains. Third-party platforms or payment processors may utilize cookies on their own domains. |
| Analytics performed on Customer Data | No analytics are performed on customer data using personally identifiable information |
| Data correlation practices | User identification is based on GUIDs (globally unique identifiers) to protect user privacy when correlating data |
| Privacy Certifications or Seals | SOC 2 Type 1 Audit, SOC 2 Type 2 Audit, ISO/IEC 27001:2013 Certification, IMS TrustED Apps Seal, IMS LTI Certification, and iKeepSafe. |
| Targeted Advertising using user data | Proctorio does not use any client-side tracking pixels such as those used for advertising, marketing, and targeting. |
| Privacy or data protection impact assessments | |
| Privacy Law Compliance | FERPA, COPPA, CCPA, SOPIPA, GDPR. |
