Hosting and data location
Data is hosted in the client’s geographic location by default. Your institution can also keep data in its own S3 bucket.
You don’t need an LMS, ERP or campus system to run an exam on Proctorly, so you can get started without opening any connection into your own systems.
Access and isolation
Each institution’s data kept separate
Your institution’s data is kept apart from every other institution’s.
Least-privilege, logged staff access
Our staff get only the access their work needs, and every access is logged, including when our reviewers open cases.
Reviewer access limited to assigned exams
We plan to add a reviewer role that sees only its assigned exams and can’t change marks, change your policies or impose a sanction.
Audit trail and evidence integrity
Every view, decision and change goes into a tamper-evident audit trail. You can export each case as one evidence pack with its clips, timeline, decisions and audit entries, so an appeal panel or auditor can see exactly what happened and who did what. See human review proctoring.
Security testing
Vulnerability assessment and penetration testing
An empanelled auditor carries out our vulnerability assessment and penetration testing, and we can share a summary on request.
Sign-in and integrations
- Moodle: live. Moodle monitoring with OAuth and LTI 1.3 is live and supports Canvas, Blackboard, and other learning platforms. Proctorly can monitor an exam that stays in Moodle, in any browser. Sign-in and exam launch go through Moodle’s own login (OAuth 2), a plugin supports earlier versions of Moodle, and the LTI 1.3 Advantage connection handles launch, roster and grade return.
- Single sign-on: sign-in with Microsoft accounts is planned, and so is Google sign-in.
- Canvas, Blackboard, D2L Brightspace and other learning platforms: live. They connect through LTI 1.3 and are supported today. For each LMS we will publish the versions tested and the exact services supported.
Every connection is listed on LMS integrations.
Data use, retention and subprocessors
- We don’t use candidate recordings or data to train AI models unless your institution opts in.
- Your institution sets retention, exam policy by exam policy. A documented deletion process covering live storage and backups is planned.
- Our main subprocessor is listed on our subprocessors page. The full, current list is in the data processing agreement, and we can send it on request.
For what each assurance level captures and why, see proctoring privacy. For what each setup can and can’t observe, see what we can and cannot see.
For CIOs and IT heads: questions we are asked
Can we keep exam data in our own cloud account?
Yes. Data is hosted in the client’s geographic location by default, and your institution can keep data in its own S3 bucket instead. Tell us what you need during setup. The security and integration pack covers the options in detail for your review.
How is Proctorly’s security tested?
An empanelled auditor carries out vulnerability assessment and penetration testing, and a summary is available on request. Our hosting, access controls and data handling are set out in the security and integration pack for your review.
Can our staff and your staff see each other’s data?
Each institution’s data is kept apart from every other institution’s. Our own staff get least-privilege access, and every access is logged, our reviewers’ included. Each view, decision and change on a case goes into a tamper-evident audit trail, so you can see who looked at what.
Do we have to connect Proctorly to our LMS or ERP?
No. Exams run inside Proctorly, so you don’t need an LMS, ERP or campus system. If you do use one, Moodle monitoring with OAuth and LTI 1.3 is live and supports Canvas, Blackboard, and other learning platforms. An exam can stay in Moodle with sign-in through Moodle’s own login, and D2L Brightspace connects through LTI 1.3 as well.