Most of the protection is data that never exists.
The cheapest way to keep candidate data safe is not to collect it. Where collection is unavoidable, here is exactly what happens to it, and the frameworks we hold ourselves to.
The frameworks we build and operate against.
Candidate data is minimised by default, held only as long as your retention policy allows, and never shared beyond the institution that owns it. Where a market adds a requirement, we meet the stricter of the two rather than the more convenient.
-
AICPA SOC 2 Trust services criteria -
GDPR General Data Protection Regulation, EU -
Act 843 Ghana Data Protection Act, 2012 -
Act 1038 Ghana Cybersecurity Act, 2020
What that means in practice.
Each of these is something you can hold us to during a procurement review or a security questionnaire.
-
Where data lives
- Held on managed infrastructure inside the European Union, encrypted at rest and in transit
- Recorded media is never publicly reachable and is served only through short-lived, signed links that expire
- Media never travels through the application interface, so an interface flaw cannot expose a recording
- Session state expires on a timer rather than lingering
- Residency in another region is available where a contract requires it
-
Tenant isolation
- Every institution is a separate tenant on shared infrastructure
- Records and stored files are partitioned by institution at the storage layer
- The tenant is derived from a validated credential in shared middleware, never from anything the browser sends
- No interface accepts a tenant identifier from the client as the basis for reading data
-
Access and identity
- Staff accounts require multi-factor authentication
- Candidates never hold accounts. They carry a short-lived credential scoped to one exam
- Internal services authenticate with rotating machine identities, never stored passwords
- Least privilege is applied per service, so a compromise is contained to that service
-
Separation of duties
- Reviewers cannot modify exams, exam rules, or licences
- Administrators cannot modify a review determination
- Crediting a licence pool requires a second operator to approve it
- The separation is enforced in the interfaces and behind them, not by policy alone
-
Candidate privacy
- On the Lite tier the checks happen live and nothing is written down. No biometric media is retained
- The tier system exists so an exam is never recorded more heavily than it warrants
- No government ID registry is ever contacted, in any market
- Retention periods are yours to set, and deletion actually happens on them
- Candidate data is never sold, never shared for advertising, and never used to train anything
-
Engineering practice
- Infrastructure is defined as code. Every change shows its effect before it is applied
- Deployment uses short-lived federated credentials. There are no long-lived cloud keys anywhere
- Dependency and infrastructure scanning run on every change, and a new high-severity finding blocks the release
- The audit record is append only. Decisions, actions and result changes are written once and never edited
What we will put in writing.
This page states the guarantees. It deliberately does not name the products and services behind them, because that detail helps an attacker and a competitor more than it helps a buyer.
Under an NDA we go much further. Ask early rather than at the end of a procurement cycle, and you will get a straight answer about what exists today.
Ask for the pack- Under NDA
Architecture and data flow
Full diagrams, from the candidate device to storage.
- Under NDA
Sub-processor list
Every third party we rely on, named.
- Under NDA
Retention and incident response
Schedules and commitments in writing.
- Under NDA
Completed questionnaires
Whichever standard your institution uses.
Send us your security questionnaire.
We would rather answer it now than at the end of a procurement cycle.
Or email admin@examlense.com