Test Taker Privacy and Data Security

It's natural to have questions and concerns regarding the data used in online exam proctoring. Proctor360 firmly believes that openness and transparency about data collection and usage are fundamental to maintaining the integrity of online tests. The information on this page will help you better understand what information is captured and recorded and how it is used.  It is important to note that the institution that offers the exam you take makes the rules for the exam and prescribes what data we should collect and record as we proctor their test takers' exam sessions.

Proctor360 adheres to the highest standard of customer data security with SOC 2 compliant policies, controls, and continuous monitoring to ensure that the data we collect and store for our customers is safe.  SOC 2 is globally recognized as one of the most stringent standards for information security compliance. Developed by the American Institute of CPAs (AICPA), this certification involves an in-depth audit by a third-party auditor, scrutinizing a service company's internal controls pertaining to information security.

In this ever-evolving digital landscape, rest assured that Proctor360 is steadfast in its commitment to protecting your data and upholding the highest standards of information security. In keeping with that commitment, we've launched our Trust Center where interested parties can view all the controls currently monitored by Secureframe for compliance and access our audit reports.

Our customer data is not for sale.

Proctor360's singular goal is to build tools and technology that can protect the integrity of online exams for schools, colleges, organizations, and institutions that want to reach a wider audience of candidates by delivering exams remotely.  We do not sell or license any customer data or any derivative thereof to third parties.

FERPA is a Federal law that protects personally identifiable information in students’ education records from unauthorized disclosure. It affords parents the right to access their child's education records, the right to seek to have the records amended, and the right to have some control over the disclosure of personally identifiable information from the education records. When a student turns 18 or enters a postsecondary institution at any age, the rights under FERPA transfer from the parents to the student (“eligible student”). The FERPA statute is found at 20 U.S.C. § 1232g, and the FERPA regulations are found at 34 CFR Part 99.

How is Proctor360 governed by FERPA?

Proctor360 acts as a contracted third-party service provider for schools and institutions that may be subject to FERPA regulation.  In order to provide remote proctoring for these organizations' student exams online, certain information must be shared with and/or maintained by Proctor360:

• Student Name
• Student Email Address
• Student ID number
• Exam Session Recordings & Related Data

This information is stored in each school's unique account which can only be accessed by the school's authorized staff-members or Proctor360 personnel.  Proctor360 does not voluntarily share or disclose this information with any other party or agency without being compelled by a court of valid jurisdiction. 

When schools and districts outsource institutional services or functions, FERPA permits the disclosure of PII (Personally Identifiable Information) from education records to contractors, consultants, volunteers, or other third parties (like Proctor360) under a "School Official Exception" provided that the outside party

1. performs an institutional service or function for which the agency or institution would otherwise use employees;
2. has been determined to meet the criteria set forth in the school’s or district’s annual notification of FERPA rights for being a school official with a legitimate educational interest in the education records;
3. is under the direct control of the agency or institution with respect to the use and maintenance of education records; and
4. uses education records only for authorized purposes and may not re-disclose PII from education records to other parties, unless the provider has specific authorization from the school or district to do so and it is otherwise permitted by FERPA. (See 34 CFR § 99.31(a)(1)(i)).

In short, your school is in charge of the data we maintain, and outside parties must contact them and receive consent before Proctor360 will provide anyone else to access it.  If Proctor360 is compelled by a court to disclose any data directly without contacting your school, we would first conduct a legal review and immediately notify them while following the appropriate compliance procedures that may be relevant to the particular situation.

According to the U.S. Department of Education, when Personally Identifiable Information from relevant education records is disclosed to Proctor360, FERPA still governs its use, and the school or district is responsible for its protection.

By limiting access to your student data to authorized members of your school's staff, directing all review and disclosure requests to them, and enforcing SOC 2 data security controls for all the data we maintain (as described earlier on this page), Proctor360 maintains compliance with FERPA regulations.