Building for neurodiversity starts inside the company
Read blog Solution overview
See all of Proctorio's solutions side by sidePrivacy and security
Proctorio exceeds industry standards with layered encryption, third-party audits, and global compliance.
Read Privacy PoliciesYour privacy, simplified
Proctorio limits the personal information collected from end users. All exam audio, video, and screen recordings are end-to-end encrypted and can only be decrypted by institution-approved representatives.
Three layers are better than one
At Proctorio, we prioritize safeguarding this data, and make an active effort to protect individual, recording, and personally identifiable information.
End-to-end
The end-to-end encryption layer is secured using AES-GCM.
In-transit
Data transmitted over TLS 1.2/1.3 with Perfect Forward Secrecy (PFS) support.
At rest
AES-256 encryption, FIPS 140-2 compliant. All data centers are ISO 27001 certified.
Data processor vs data controller
Data processor
As a data processor for "Institutions" (organizations and customers utilizing Proctorio Services), Proctorio processes test-taker Personal Information (information that identifies an individual, as defined more fully under applicable law) only on Institution instructions, and encrypts it in these instances. Exam recordings received from the Institution are protected by end-to-end encryption; only approved "Institution representatives" (instructors, faculty, administrators, and other authorized staff) can access test-taker Personal Information, since Proctorio holds no cryptographic key and cannot access or disclose it.
Data controller
The Institution is the data controller ("controller"), and its privacy policy governs the processing of test-taker and Institution-representative Information. The Privacy Policy below offers test-takers and Institution representatives a general understanding of Proctorio's privacy practices, but they should also review their respective Institution's controlling privacy policies.
Updates
Proctorio is constantly improving and expanding, so we may need to update this Privacy Policy from time to time. If so, Proctorio will post its updated Privacy Policy on Proctorio's Site located at proctorio.com, include a notice on the homepage of proctorio.com, and include updates on Github.
You do not have to be registered users of GitHub to view these updates. Please visit Github to see Proctorio's page regarding updates.
Proctorio encourages you to review this Privacy Policy regularly for any changes. Your continued use of the Services and/or continued provision of Personal Information to Proctorio will be subject to the terms of the then-current Privacy Policy.
Compliance
Proctorio makes every effort to comply with the highest privacy and data security standards.
United StatesEuropeCanada
FERPA
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records and applies to schools receiving funds from the U.S. Department of Education.
Visit FERPACOPPA
The Children's Online Privacy Protection Act (COPPA) is a federal law that sets forth rigid requirements for websites or online services that may collect information from children under 13 years of age.
Visit COPPACCPA
The California Consumer Privacy Act (CCPA) of 2018 gives consumers more control over the personal information that businesses can collect and requires businesses to give consumers notice of their privacy practices.
Visit CCPASOPIPA
The Student Online Personal Information Protection Act (SOPIPA) of 2016 prohibits companies and institutions from sharing student data and using that data for targeted advertising on students for a non-educational purpose.
Visit SOPIPAAB No.1584
The Assembly Bill No. 1584 added to the Education Code authorizes local educational agencies, as appropriate, to enter into a contract with a FERPA compliant 3rd party to provide digital educational software.
Visit AB No.1584GDPR
The General Data Protection Regulation (GDPR), otherwise known as the European Data Protection Regulation, went into effect in May 2018 and acts to harmonize privacy laws across Europe.
Visit GDPRFIPPA
The Freedom of Information and Protection of Privacy Act (FIPPA) provides Canadian citizens with the right to access information under the control of institutions.
Visit FIPPA
SOC 2 Type 2 Audits
Proctorio partners with A-LIGN, an independent, third-party auditor, to complete our SOC 2 Types 1 and 2 (System and Organization Controls) cybersecurity audits. These audits assess the privacy, confidentiality, security, availability, and processing integrity of our software. Being SOC 2-compliant means Proctorio is designed to keep our users' private data secure.
ISO/IEC 27001:2022 Certification
In June 2024, Proctorio achieved ISO/IEC 27001:2022 certification, an information security certification developed by the International Standards Organization (ISO) and the International Electrotechnical Commission (IEC) to standardize the process for establishing, implementing, operating, reviewing, and maintaining an ISMS (Information Security Management System). ISO 27001 focuses on data confidentiality, integrity, and availability and certifies that our ISMS was implemented and managed effectively.
ISO 27018 Certification
Proctorio achieved ISO 27018:2025 certification in 2026. An extension of our ISO 27001 certification, ISO 27018 provides 25 additional privacy and security controls. This newer certification from the International Standards Organization examines the capacity of Proctorio's cloud to handle personally identifiable information (PII) and ensures user information and data are protected.
ISO 42001 Certification
Proctorio achieved ISO 42001 certification in June 2025. This certification from the International Standards Organization is the world's first international standard for AI management systems, establishing requirements for developing, implementing, and maintaining an AI management system. ISO 42001 ensures that Proctorio's artificial intelligence systems are deployed responsibly, with appropriate governance, risk management, and ethical considerations in place to protect users and maintain transparency.
Audited by A-LIGN and partnered with Hackrate
We have partnered with Hackrate, a leading ethical hacking company. This partnership allows us to ensure that our software remains secure, private, and accessible for our end users: test-takers and exam administrators.
Questions about privacy?
Reach out to us
by mail
US: 7340 E Main St, Suite 203 Scottsdale, AZ 85251
Rest of World: Lindleystraße 8a, 60314 Frankfurt am Main-Bornheim/Ostend, Germany
