Privacy

What ExamSafe records about a student, why, and how long it is kept.

Who holds this data

Each school's data is held separately and is reachable only by staff of that school. A school is identified by its Google Workspace domain, and a student or staff member can only ever reach their own school's sittings.

What is collected about a student

• Their school email address and name, taken from the Google account they sign in with. The name is used to label the file staff receive.
• Which sitting they joined, when they started, and when they last responded.
• When they submitted, and the identifier of the file created in Drive.
• A record of events during the sitting: starting, submitting, a failed unlock attempt, a failed save, a session recovered after a crash.

ExamSafe does not use a camera or microphone to observe a student, does not record the screen, and does not read what a student types. Dictation, where a school has granted it, runs on the student's own Mac and no audio leaves the machine.

The work itself

A student's answers are written to their own computer during the sitting and, on submitting, to a file in their own Google Drive. Ownership of that file is then transferred to the staff member named on the sitting. The work is not stored by ExamSafe: the portal records that a submission happened and the file's identifier, nothing more.

Where a school has turned it on, submitting removes the student's own access to that file, and a supervisor can ask the student's computer to delete its local copy once the work has been received.

Google account access

Students grant access to create files in Drive. This is Google's drive.file permission, which reaches only files ExamSafe itself created: it cannot see anything else in a student's Drive.

Staff signing in to this portal additionally grant read-only access to group membership, used solely to check whether they are in the group their school has nominated as staff. No other directory information is read.

How long it is kept

• An assessment paper uploaded by staff is deleted a day after the sitting is closed.
• The roster and event record for a sitting are kept while the sitting exists, and are deleted with it. Deleting a sitting in the portal removes them permanently.
• Submitted work is in the school's Google Drive and is governed by the school's own retention, not by ExamSafe.

Who it is shared with

Nobody. Data is not sold, not used for advertising, not used to train anything, and not passed to any third party. It is held on a server operated for ExamSafe and reachable only by staff of the school it belongs to.

Asking about your data

A student or family should speak to their school first: the school holds the work and decides its retention. Schools can contact ExamSafe through the address on their agreement.

Last updated 21 August 2026.