Your data is safe

Submissions, results and proctoring recordings are hosted in France, at Scaleway and in the AWS eu-west-3 (Paris) region. Nothing is replicated outside Europe, backups included, and no US or Asian region is used.

Any transfer is covered by the European Commission's standard contractual clauses, as articles 44 to 49 of the GDPR provide. Where the six other French platforms host their data: see the comparison of online exam platforms.

In transit and at rest, backups included: encryption is one of the measures that article 32 of the GDPR names.

Through defense in depth: it is the stacking of measures that shrinks the attack surface.

The GDPR does not ban remote proctoring, but it rules out decisions based solely on automated processing (article 22), places strict limits on biometric data (article 9) and calls for an impact assessment where the risk is high (article 35).

The organizer is the data controller, Evalmee its processor under article 28 of the GDPR. Nothing is enabled by default: every mechanism is set exam by exam, so the organizer switches on only what it can justify.

Based in France, Evalmee applies by default the CNIL's délibération no. 2023-058 (June 8, 2023). It does not bind outside France, but it goes into the detail of each measure: proportionality is assessed “as a whole and not measure by measure” (§ 33), “in the light of the context and of what is at stake in the exam” (§ 34). The table sets out its paragraphs, with what Evalmee does.

The 2026 edition of ISO/IEC 17024 adds requirements on data protection, AI and technology-related security, which apply to the body, not the platform.

Details: ISO/IEC 17024 and certification bodies pages.

Not on the Mini, Pro and Max plans, which use no webcam: no video, no identity verification, no biometrics. Identity verification belongs to the Organization plan: a comparison of documents checked by eye by the examiner, the first arrangement the CNIL names in § 43, and, on quote, automated validation.

Three months by default for screenshots and video proctoring recordings (Organization plan), the time needed to handle appeals. Everything else follows the period you set as the data controller: Evalmee keeps nothing on its own initiative.

Access restricted to examiners of the client organization, with optional logging of who consults what. Distribution or external reuse prohibited, save for a legal obligation or a formal request from the authorities; the client organization may download the recordings for its archiving and its accreditations.

Evalmee uses OpenAI models to speed up authoring and grading, under four conditions.

The full list is public, dated and kept up to date: provider, purpose and country of establishment, as article 28 of the GDPR requires. Your data goes only to the partners strictly necessary.

For authoring and for grading open questions, OpenAI receives the question, the rubric and the answer, without the participant's name or identifier. The optional analysis of the webcam and microphone, on the Organization plan, runs on Evalmee's servers and adds no sub-processor.

Yes, compliant with article 28 of the GDPR: respective responsibilities, retention periods, security measures and sub-processors. It is signed before go-live, at no extra cost, whatever your plan.

Evalmee is built so that your institution can process exam data in line with the GDPR; compliance is judged processing by processing, under your responsibility.

None, to date, in its own name: the certifications cited on this page are those of our hosting providers.

As of August 14, 2026, Evalmee's public status page shows 100% observed availability over the last ninety days for its seven components, remote proctoring included: a figure over a rolling window, not a contractual commitment.

No SLA on self-service plans; an availability commitment can be negotiated on the Organization plan. The status page also publishes the incident history, updated automatically.