Centre de ressources

The US Department of Education's Privacy Technical Assistance Center published a presentation titled Security Threats: Education Systems in the Crosshairs, in which security advisor Mike Tassey documented how data breaches, hacks, and privacy incidents have affected organizations across virtually every sector, from NASA and Citigroup to local school systems.

The warning is directly relevant to any organization using online proctoring. The data that proctoring services collect, including names, government-issued ID, biometric images, and session recordings, is exactly the kind of information that makes education systems a target.

The Threat Landscape Has Changed

Cyber-theft has become fully commoditized. There is an active black market for personal data, and an underground economy where over two million pieces of malware are built and sold every year. This malware is designed to gather precisely the kind of information proctoring platforms collect: Social Security numbers, addresses, birth dates, and identity credentials.

Tassey specifically noted that children's identities are particularly valued by data thieves because they are, in his words, fresh. A child's identity may go undetected for years before the theft is discovered, making it a high-value target for long-term fraud.

The alarming part is how malware typically gets onto devices. It is not usually through pirated software or poor security settings. It enters through plugins and browser extensions that users install themselves, often for legitimate purposes. The installation is the vector.

Why Proctoring Plugins Create Specific Risk

Most online proctoring services require users to install browser extensions or plugins to enable monitoring. Each of these installations represents an opportunity for malware to enter the device, either during the initial installation or through a subsequent update, without the user's knowledge or permission.

Tassey's research notes that on average there are one to five bugs for every 1,000 lines of code. For organizations that have not completed independent code reviews of the proctoring software they deploy, those bugs represent an unexamined attack surface. Malware can be introduced into code updates without detection, meaning a plugin that was clean at installation may not remain so.

At minimum, organizations should be instructing learners to disable or uninstall proctoring plugins and extensions immediately after use. The risk does not end when the exam does.

What a Code Review Should Cover

Organizations that require learners to install proctoring software should conduct, or require their vendor to provide evidence of, a code review that addresses:

• Potential malware embedded in the plugin or extension code
• Errors or vulnerabilities that could be exploited by third parties
• Whether the software receives automatic updates, and what review process governs those updates
• What data the software transmits, to where, and under what conditions

If a vendor cannot provide clear answers to these questions, the software should not be deployed on learner devices.

The Case for No-Installation Proctoring

The most effective way to eliminate installation-based security risk is to remove the installation requirement entirely. Integrity Advocate's platform is browser-based and requires no plugin, extension, or application installation in most cases. There is nothing to install, nothing running in the background after the session ends, and no update mechanism that could introduce malware without the user's knowledge.

For use cases that do require a lockdown browser, Integrity Advocate's solution uses fully open source code, does not accept automatic updates after installation, and does not transmit data beyond what is required for the session. The code is publicly available for inspection.

The US Department of Education's guidance on protecting student privacy points to the same principle: the safest data handling approach minimizes what is collected, minimizes how long it is retained, and minimizes the software footprint on learner devices.

{{post-cta}}

The California Consumer Privacy Act gives California consumers significant control over their personal information. For online proctoring platforms that collect identity data, facial images, and session recordings from California-based test takers, CCPA compliance is directly relevant to how that data must be handled, disclosed, and deleted.

This guide explains what CCPA requires, how it has been strengthened since 2018, and how Integrity Advocate is built to meet and exceed its requirements.

What Is the CCPA and Who Does It Apply To?

The California Consumer Privacy Act of 2018 was established to give consumers more control over the personal information that businesses collect about them. It has since been strengthened by the California Privacy Rights Act, which came into effect on January 1, 2023, adding new consumer rights and expanding the scope of covered businesses.

CCPA applies to for-profit businesses that do business in California and meet at least one of the following thresholds: annual gross revenue over $25 million, buying or selling the personal information of 100,000 or more consumers or households per year, or deriving 50 percent or more of annual revenue from selling personal information.

Integrity Advocate does not fall within these threshold criteria. However, through its adherence to Privacy by Design principles, Integrity Advocate meets and exceeds CCPA's requirements by default. For organizations using Integrity Advocate that are themselves subject to CCPA, this means your proctoring vendor is not creating compliance risk on your behalf.

CCPA Consumer Rights and How Integrity Advocate Meets Each One

The Right to Know

Consumers have the right to know what personal information a business collects about them, how it is used, and whether it is shared or sold.

Integrity Advocate provides this transparency proactively, without requiring any action from the test taker. After every completed and reviewed session, Integrity Advocate emails each user a copy of the data retained about them, the review findings, and the reviewer notes. Test takers can verify exactly what information was collected and what conclusions were drawn from it, without needing to submit a formal request.

The Right to Delete

Consumers have the right to request that businesses delete personal information collected from them, and to require their service providers to do the same.

Integrity Advocate addresses this by default. All unnecessary data, defined as data not required to document who participated in the session or to support a documented rule violation, is deleted automatically after session completion. The limited data retained is deleted after 24 months unless a specific client or regulatory requirement necessitates a different retention period. Data can also be deleted earlier upon individual request.

The Right to Opt Out

Consumers may request that businesses stop selling their personal information. Businesses cannot sell personal information after receiving an opt-out request, and must wait at least 12 months before asking the consumer to opt back in.

Integrity Advocate has never sold, shared, or transferred personal information to any third party. The Integrity Advocate privacy policy explicitly states that users own their personal data and it cannot be sold under any conditions. There is nothing to opt out of because the sale of personal data is not and has never been part of how Integrity Advocate operates.

The Right to Non-Discrimination

Businesses cannot deny goods or services, charge a different price, or provide a different level of service to consumers who exercise their CCPA rights.

Because Integrity Advocate provides all CCPA rights to every user by default, there is no scenario in which a user exercising their rights would result in different treatment. The protections are built into the platform, not granted on request.

The Right to Correct (Added by CPRA 2023)

The California Privacy Rights Act added the right for consumers to request correction of inaccurate personal information held by a business.

Integrity Advocate's human review process directly supports this right. Every flagged session is assessed by a trained reviewer before any finding is recorded, significantly reducing the likelihood of inaccurate information entering the record in the first place. Where a test taker believes information is inaccurate, the documented session record and human reviewer notes provide the basis for a meaningful correction process.

The Right to Limit Use of Sensitive Personal Information (Added by CPRA 2023)

The CPRA added the right for consumers to limit how businesses use sensitive personal information, including biometric data.

Integrity Advocate collects biometric data, specifically facial images for identity verification, only for the stated purpose of confirming learner identity. This data is not used for any secondary purpose, is not shared beyond what is required to document a specific finding, and is deleted within 24 hours of session completion for compliant users.

Why Privacy by Design Matters for CCPA Compliance

CCPA compliance is easier to demonstrate when privacy protections are built into the product architecture rather than managed through policy responses to individual requests. Integrity Advocate's Privacy by Design approach means that data minimization, deletion timelines, and disclosure limitations are not reactive measures. They are foundational design decisions that apply to every user in every session by default.

For organizations using Integrity Advocate that are themselves subject to CCPA, this means the proctoring vendor you have chosen is not creating compliance exposure on your behalf. It means your learners' data is handled in a way that meets California's privacy standards without requiring your team to manage it.

CCPA and the Broader Privacy Landscape

CCPA is one of several privacy frameworks relevant to US organizations using online proctoring. Depending on the nature of your program and the location of your learners, FERPA, BIPA, GDPR, and other state-level privacy laws may also apply. Integrity Advocate is designed to support compliance across multiple frameworks simultaneously, with the same Privacy by Design architecture underlying each.

{{post-cta}}

D2L Fusion wrapped in Phoenix earlier this month, and our CEO, Brandon Smith, spent the week doing what he does best: showing up on the floor, listening to educators, and bringing ideas about the future of assessment back to the team.

Brandon recorded a short recap video at the end of each day. But what stuck with him most happened during D2L's product keynote, when Chief Product Officer Christian Pantel challenged the room with three questions he couldn't stop thinking about. So he worked through what each one means for how he leads Integrity Advocate.

Here's that video:

The Three Questions

• How do we embrace technology responsibly?
• How do we safeguard learner data?
• How do we earn and maintain our stakeholders' trust?

Embrace Technology Responsibly

The first question isn't really about AI. It's about responsibility. Are we solving a real problem, or adding technology simply because we can? AI is already changing education, and it has tremendous potential to help educators and institutions make better decisions. But it shouldn't replace human judgment when those decisions have meaningful consequences.

That's one of the reasons we've doubled down on Verified by Human Review™. AI can identify patterns and surface potential concerns, but people provide the context, judgment, and accountability that technology alone can't.

Safeguard Learner Data

This was probably the easiest question for Brandon to answer, because privacy is foundational to why Integrity Advocate exists. It isn't something you add after a product is built; it shapes how the product gets built from the beginning. That means carefully considering what information is collected, why it's needed, how it's protected, and how long it's retained. It also means continuing to evaluate those decisions as expectations and regulations evolve.

In practice, that shows up in specific choices: minimizing what's captured during a proctored session in the first place, giving institutions control over retention windows rather than defaulting to "keep everything," and building review workflows so human reviewers see only what's relevant to a flagged concern. Integrity Advocate was built around Privacy by Design, and it remains one of our core principles.

Earn and Maintain Trust

This was the question that made Brandon think the longest. It's easy to say trust is important. It's much harder to earn it every day. For him, trust comes down to transparency and accountability. Sometimes that means celebrating what's working. Sometimes it means picking up the phone when something isn't.

One of his first experiences as CEO was joining an outage call with a customer. The team didn't have all the answers yet, but they were honest about what had happened, what they were doing to fix it, and how they'd prevent it from happening again. That's what earning trust looks like. It's not about being perfect. It's about showing up, taking ownership, and continuously improving.

Day by day on the ground in Phoenix

Alongside the reflection above, Brandon recorded a short recap after each day of Fusion. Here's a quick look back at all three.

Day 1 — AI Needs People

The opening keynote reinforced something I've believed for a long time: AI has incredible potential, but it isn't a replacement for educators or human expertise. Technology should support better learning experiences, not try to replace the people responsible for them.

John Baker said something that really stuck with me: that technology cannot run education. It should empower educators, not replace them. That aligns closely with how we think at Integrity Advocate. AI is an incredibly valuable tool, but it works best when paired with human judgment. Whether it's proctoring, identity verification, or reviewing assessment outcomes, people still need to be part of the decision-making process.

Key takeaway: The future isn't AI versus humans: it's AI supported by humans.

Watch Brandon's Day 1 recap here:

Day 2: Innovation Must Earn Trust

Day two shifted the conversation from what technology can do to how organizations should build and use it responsibly. One session framed the challenge around three important questions: How do we embrace innovation responsibly? How do we safeguard learner data? And how do we earn and maintain trust?

Those themes came up throughout the day in conversations about accessibility, user experience, privacy, and AI. They also made receiving D2L’s Customer Trust Award especially meaningful. The recognition reflects the work our team puts into supporting customers, building dependable partnerships, and creating technology people can trust.

The award was an honor, but it also reinforced the responsibility that comes with trust: to keep listening, keep improving, and continue putting learners and customers at the centre of how we build.

Key takeaway: Trust is not something a product claims. It is something a company earns through every interaction.

Day 3: Trust Will Be the Competitive Advantage

As Fusion wrapped up, one theme stood above everything else: organizations that succeed with AI will be the ones that balance innovation with privacy and trust.

The conversations weren't just about online proctoring anymore. We spoke with educators about broader assessment challenges and with partners about new applications for our technology. Those discussions reinforced that the opportunity extends beyond protecting exams, it's about helping organizations create trusted learning experiences wherever assessment happens.

The three questions introduced during the keynote stayed with me all week because they reflect the direction our industry is heading. As learning continues to evolve, technology alone won't be enough. Success will belong to organizations that combine responsible AI, strong privacy practices, and meaningful human oversight.

Key takeaway: The future of assessment integrity will be built on innovation, privacy, and trust—not technology alone.

Brandon shares his closing thoughts from the floor here:

Thanks to everyone who stopped by our booth, sat in on Brandon's session, or caught up with the team in Phoenix. Christian's three questions are worth sitting with, however you answer them.

Some of our favorite moments from D2L Fusion:

{{post-cta}}

In fast-moving manufacturing and warehousing environments, safety training often becomes a checklist item: toolbox talks, refresher videos, signed attendance sheets. But when a forklift collision, chemical spill, or lockout failure occurs, those documents won’t protect you.

During OSHA or WHMIS audits, investigators no longer accept “completed” modules at face value. They want proof that workers were verified, supervised, and compliant. Without verifiable certification, even well-intentioned training can collapse under scrutiny.

What’s Really at Stake for Manufacturing & Warehousing Safety

Relying solely on internal talks or self-paced online courses carries hidden costs:

• Audit exposure: OSHA and WHMIS investigators increasingly require verifiable certification records, not just completion logs.
• Incident fallout: A single uncertified operator can trigger investigations, halt production, or cause preventable harm.
• Union accountability: Gaps in training verification can lead to grievances, arbitration, or reputational fallout.
• Downtime and damage: Safety failures don’t just hurt people, they disrupt schedules, contracts, and client trust.

In an industry built on precision and accountability, compliance must be defensible.

Closing the Gap Between Training and Proof

Most manufacturers don’t think of “proctoring” as part of their safety program, and that’s exactly where the gap lies.

Proctoring simply means verifying who took the training, and how. In education, it prevents cheating on exams. In manufacturing, it ensures your workers, the ones who actually operate forklifts, handle chemicals, or enter confined spaces, are the same people who completed the safety training and passed the test.

Without that verification, online certifications become risky. Anyone can click through a course, have someone else take it for them, or pass without fully understanding the material. That’s how unsafe practices slip through and incidents happen.

Verified training closes that gap. By monitoring and documenting the testing process, without adding friction to your operations, you gain defensible proof that every worker on the floor is properly certified. It’s the difference between saying “we trained them” and proving “we can stand behind every certification in this facility.”

How Integrity Advocate Helps

Integrity Advocate was built for compliance-driven sectors where one mistake can mean lost time, lost contracts, or worse.

Our hybrid proctoring solution combines intelligent automation with live human oversight to verify identity, monitor integrity, and record every certification attempt. The result: transparent, defensible documentation that passes any audit and protects your people.

We help manufacturing and warehousing operations:

• Pass audits confidently: Generate instant, audit-ready verification reports for OSHA, WHMIS, or client inspections.
• Reduce downtime: Employees certify remotely on their own schedules, no need to pull equipment or staff off the floor.
• Streamline onboarding waves: Verify large training groups quickly without bottlenecks or scheduling conflicts.
• Align with union and safety standards: Provide verifiable, human-reviewed records that satisfy committees, regulators, and insurers alike.

See How Integrity Advocate Safeguards Industrial Operations

Don’t let a preventable incident or failed audit reveal a weak spot in your training program.
See how verified certifications can protect your people, your productivity, and your reputation. Schedule a Demo.

{{post-cta}}

User experience is more than aesthetics.

It’s ease of access. 

It’s stress reduction. 

It’s whether your learners can start and finish a high-stakes training exam without technical hiccups, confusion or a call to support. 

In industries that rely on secure assessments—like workplace safety, certification and professional training—where compliance pressure meets real-world complexity, UX can be the quiet variable that makes or breaks success.

Too often, organizations prioritize visual polish over functionality, choosing sleek-looking platforms that create more problems than they solve. Others hyper-focus on security and compliance (as they should!) but overlook how the platform actually performs under pressure. If users can’t launch a test, verify their identity easily or navigate the process with confidence, the tool stops being an asset and starts being a liability.

Let’s talk about the return on doing things right. 

The business case for better UX

In high-stakes, compliance-driven environments, the design of your proctoring solution directly influences learner behavior and, by extension, business outcomes.

Research on online learning consistently shows that confusing, hard-to-navigate systems discourage learners and disrupt behavioral engagement. As one study put it: “A disorganized LMS will discourage students and create unnecessary frustration.”

That frustration has consequences.

When learners struggle to access, understand or complete assessments, organizations pay the price:

• Learners abandon exams or disengage midway
• Administrators are pulled into unnecessary troubleshooting
• Support teams are overwhelmed with avoidable tickets
• Compliance goals are missed due to incomplete or invalid training

Each of these pain points eats into your ROI through lost time, missed certifications or reputational risk. That’s why a streamlined, no-install solution like Integrity Advocate doesn’t just support the user—it safeguards the entire training program. By eliminating friction, reducing confusion and boosting learner confidence, good UX becomes a subtle but powerful business advantage.

Compliance and the new standard of accountability

Frameworks like ANSI/ASSP Z490.1-2024 and GDPR may focus on occupational safety and data privacy domains, but they share a common expectation: systems must be built with the user in mind.

The updated ANSI standard raises the bar for training programs, emphasizing not just content but how that content is delivered. Training must be accessible, effective and verifiable. GDPR reinforces the same principle from a privacy angle. Its mandate for data minimization requires that organizations collect only what’s necessary, building trust by reducing exposure and respecting user boundaries.

So when training fails to meet compliance standards like these—when it’s ineffective, inaccessible, or poorly delivered—the consequences aren’t just digital. They’re human. That’s why standards like ANSI/ASSP Z490.1-2024 are evolving to ensure training does more than meet requirements. It needs to stick. It needs to protect.

What does user-centric compliance look like?

• Training that works on any device, with no downloads or technical hurdles
• Seamless identity verification that doesn't require excessive data collection
• Monitoring that confirms engagement without violating user privacy
• Support that’s fast, helpful and always available

When tech gets in the way, trust breaks down

When students describe what makes a great learning experience, the message is clear. According to EDUCAUSE’s 2025 Student and Technology Report, only 34% of students who believe their institution is “behind the times” in technology adoption are satisfied with their learning tech and support services. In contrast, 85% of students who perceive their institution as cutting-edge report high satisfaction.

Satisfaction starts with tools that reduce stress, not add to it.

• Learners want intuitive login systems and reliable access
• Confusing platforms disrupt focus and lead to disengagement
• Technical issues with assessments erode confidence in the entire credentialing process

Users themselves are asking for simpler, more seamless platforms. When it’s not, even minor friction points can become trust breakers. As one EDUCAUSE respondent summed up clearly: “Any technological issues I have had... have been quickly righted by IT support or professors.”

That level of responsiveness builds trust. In higher education, students often rely on IT or instructors to step in when tech fails. But in workforce training, compliance testing or professional certification environments, that safety net rarely exists. There's no time for help desk tickets or make-up exams when the stakes are high and the schedules are tight.

That’s where reliability becomes ROI.

The cost of getting it wrong

Compliance standards were developed for a reason. Gaps in your training system’s integrity don’t just show up in learner complaints online—they show up in audit findings, reputational hits and real-world risk.

• Retesting costs: Every invalid assessment leads to rework. For many organizations, this results in lost hours, disrupted schedules and, in some industries, extended periods of non-compliance.
  
• Lost productivity: If learners can’t complete their training, they can’t start work. That’s downtime for the team and delays for you.
  
• Brand and credential risk: For those in sectors such as certifying bodies and training organizations, a poor test experience reflects directly on the value of your credential. If people don’t trust the process, they won’t trust the outcome.

In other words, poor UX isn't just frustrating. It costs you.

What to look for in a proctoring platform

Whether you're onboarding a new training partner or auditing an existing tool, use this quick checklist to evaluate user experience and compliance-readiness:

• Can users start and finish an assessment without admin or IT support?
• Does the platform work reliably across devices and browsers?
• Does it avoid installs, downloads or browser plug-ins that introduce friction or risk?
• Are identity checks fast, secure and designed to minimize the amount of personal data collected or stored?
• Is participation monitored in a way that ensures compliance—ideally with the added context and fairness of human review?
• What percentage of users require support, and how quickly are those issues resolved?

If your answer to any of these is “we’re not sure,” it might be time to reevaluate.

Online proctoring, trusted by organizations who can’t afford to get it wrong

For safety regulators, credentialing bodies, global corporations and training providers, failure can be costly. 

When assessments go wrong, the fallout can include everything from invalid credentials to regulatory penalties. In some jurisdictions, failure to meet standards such as CASL (Canada’s Anti-Spam Legislation) can result in fines of up to $10 million per violation—and yes, that includes tools that improperly collect or store data.

It’s why Integrity Advocate has long championed a privacy-by-design approach to compliance. We don’t just secure the testing environment, we protect organizations, individuals and the integrity of the process itself.

• When fewer than 0.58% of users require support, your admin team stays focused.
• When assessments run seamlessly, your learners stay engaged.
• When every step—from identity verification to participation monitoring—is intuitive, ethical and effective, your organization saves time, reduces risk and strengthens credibility.

That’s the hidden ROI of great user experience. And it’s our standard.

{{post-cta}}

A few years ago, the concern about AI in online assessments was theoretical. Today it is not. GPT-powered browser plugins can prefill answers to multiple choice exam questions the moment they appear on screen, regardless of the topic or difficulty level. The learner does not need to read the question. They do not need to understand it. The answer is already there.

Integrity Advocate has been tracking this development closely. The response is ExposeAI, a new detection capability built directly into Integrity Advocate's monitoring suite.

How GPT-Powered LMS Plugins Work

Learning Management System plugins powered by generative AI have proliferated rapidly. Among the tools currently in use are Github Copilot, AnswersAI, ConchAI, Jasper, ChatSonic, Coursology, Hyperwrite, Quillbot, and Monica, among dozens of others that continue to emerge.

These tools share several characteristics that make them particularly difficult to address through standard LMS countermeasures:

• They are inexpensive or free to obtain
• They require no technical expertise to install or activate
• Once installed, they operate automatically and continuously
• They are designed to conceal their presence and adapt to detection attempts
• New variants emerge faster than most platforms can respond

As a result, organizations relying on their LMS provider to develop effective countermeasures are unlikely to find one. LMS companies have no current solutions to this threat, and the nature of these plugins makes them unlikely to be eradicated through platform-level defenses alone.

The integrity of online assessments and certifications depends on a different approach.

Why This Matters for Assessment Integrity

The implications extend beyond academic dishonesty. For organizations issuing certifications that carry regulatory or legal weight, an assessment completed with AI assistance is not a valid measure of knowledge or competency. The certification it produces is as hollow as one issued without any training at all.

The same worker who received a fraudulent safety certification from a provider that did not deliver training could receive an equally fraudulent certification from an organization that delivered the training but could not prevent AI tools from completing the assessment on the learner's behalf. The outcome is the same: a credential that does not reflect what the person actually knows.

Introducing ExposeAI

ExposeAI is Integrity Advocate's purpose-built response to AI-assisted assessment fraud. It can be incorporated into Integrity Advocate's existing monitoring suite without any technical effort from clients, and works across the full range of devices and browsers that Integrity Advocate supports, from mobile to desktop.

ExposeAI is designed to detect the presence and use of GPT-powered plugins during an assessment session, giving organizations the visibility they need to maintain the integrity of their certification and training programs in an environment where AI tools are becoming standard equipment for learners looking to shortcut the process.

This is part of Integrity Advocate's broader commitment to staying ahead of the threats that matter most to the programs it serves. Human review remains at the core of every session. ExposeAI adds a layer of detection specifically designed for the AI-assisted cheating methods that automated systems alone cannot reliably identify.

The Broader Picture

AI cheating tools are not a passing trend. They are becoming cheaper, more capable, and more widely available. Organizations that do not have a response to this threat are issuing certifications they cannot stand behind.

Integrity Advocate's approach combines human review with purpose-built AI detection, so the results your program issues reflect what learners actually know, not what an algorithm answered for them.

{{post-cta}}

If your organization serves learners based in the European Union, or if you are an EU-based organization serving anyone anywhere, the General Data Protection Regulation applies to you. GDPR is not just a European concern. It is one of the most far-reaching privacy laws in the world, and online proctoring platforms that collect identity data, session recordings, and behavioral information from EU-based learners are squarely within its scope.

Non-compliance carries serious consequences. Fines under GDPR are measured as a percentage of annual global turnover, with maximum penalties reaching 4% of annual revenue or 20 million euros, whichever is higher.

This guide explains what GDPR requires, how its seven key principles apply to online proctoring, and how Integrity Advocate is built to meet each one.

What Is GDPR and Who Does It Apply To?

The General Data Protection Regulation came into effect on May 25, 2018. It is designed to protect the privacy of EU citizens and to harmonize data privacy laws across Europe. GDPR applies if the organization collecting or processing data is based in the EU, or if the data subject, meaning the individual person, is based in the EU. This applies to all organizations regardless of where they are headquartered.

According to the European Commission, personal data is any information relating to an individual, whether it relates to their private, professional, or public life. For online proctoring, this includes names, email addresses, facial images, government-issued ID, session recordings, IP addresses, and behavioral monitoring data. All of it falls within GDPR's definition and all of it must be handled accordingly.

Why GDPR Matters for Online Proctoring Specifically

GDPR places particular pressure on proctoring services because of the sensitivity of the data they collect and the power imbalance between the platform and the test taker. Learners are required to submit to proctoring to access their assessment. They cannot negotiate the terms or choose a different provider. That makes the obligation on the proctoring platform to handle their data responsibly even more significant.

GDPR requires data protection by design, meaning privacy protections must be built into the product from the start, not added as policy language after a complaint. It also redefines consent, requiring that it be freely given, specific, informed, and unambiguous. For proctoring platforms, that means generic terms and conditions acceptance does not constitute valid GDPR consent for the collection of biometric and session data.

Any data breach must be reported to the relevant supervisory authority within 72 hours and to affected individuals if the breach relates to identity or financial data.

GDPR's Seven Key Principles and How Integrity Advocate Meets Each One

GDPR Article 5 sets out seven key principles for the lawful processing of personal data.

1. Lawfulness, Fairness, and Transparency (Article 5(1)(a))

Personal data must be processed lawfully, fairly, and in a transparent manner.

Integrity Advocate has made protecting learner privacy the foundational goal of its platform. Every user is informed of what data is being collected, what may be shared, and what will be deleted, before any collection begins. This transparency applies equally to institutions and to the learners they serve.

2. Purpose Limitation (Article 5(1)(b))

Personal data must be collected for specified, explicit, and legitimate purposes and not processed in a manner incompatible with those purposes.

Integrity Advocate restricts the processing of learner information to its stated purpose: verifying identity and confirming participation in the rules established by the client organization. It acts as an intermediary between the institution and the learner's personal data, protecting against any redistribution of that data beyond what is necessary to support a documented rule violation.

3. Data Minimization (Article 5(1)(c))

Personal data must be adequate, relevant, and limited to what is necessary for the purposes for which it is processed.

Integrity Advocate's data minimization approach eliminates unnecessary collection at every stage. Where a learner's image has been previously validated, the platform eliminates the need for ID resubmission on return visits. Government-issued ID images are deleted within 24 hours of submission. Browsing history, desktop files, and program inventories are not collected.

4. Accuracy (Article 5(1)(d))

Personal data must be accurate and, where necessary, kept up to date. Inaccurate data must be erased or rectified without delay.

Integrity Advocate provides every user with a copy of the data retained about them, the review findings, and the reviewer notes after their session is completed. This allows learners to verify the accuracy of the information held about them and the conclusions drawn from it, without needing to submit a formal request.

5. Storage Limitation (Article 5(1)(e))

Personal data must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it was collected.

Integrity Advocate deletes all unnecessary data after session completion, defined as data not required to document who participated or to support a documented rule violation. The limited data retained is deleted after 24 months unless a specific client or regulatory requirement necessitates a different retention period.

6. Integrity and Confidentiality (Article 5(1)(f))

Personal data must be processed in a manner that ensures appropriate security, including protection against unauthorized processing, accidental loss, destruction, or damage.

Integrity Advocate encrypts all user data in transit and at rest and completes as much data processing as possible on the user's device, minimizing online traffic and the volume of data transmitted to servers. Data for UK-based learners is retained within the UK or on Canadian servers based on client preference. Integrity Advocate has maintained zero data breaches across 12 or more years of operation.

7. Accountability (Article 5(2))

The controller is responsible for demonstrating compliance with all six principles above.

Integrity Advocate supports its client organizations in meeting their accountability obligations by providing the documentation, audit trail, and data handling practices that demonstrate GDPR compliance. The platform's Privacy by Design architecture means compliance is not managed through reactive policy responses. It is built into how the system works.

Data Transfers Outside the EU

GDPR places restrictions on transferring personal data to countries outside the EU unless those countries provide an adequate level of data protection. Canada has been recognized by the European Commission as providing adequate protection under GDPR, which means data transfers from the EU to Integrity Advocate's Canadian servers meet GDPR requirements by default.

For organizations with specific data residency requirements, Integrity Advocate also supports storage within the EU and in other jurisdictions based on client preference.

The Lawful Basis for Processing in Online Proctoring

GDPR requires that every instance of data processing have a lawful basis. For online proctoring, the most relevant bases are legitimate interests and legal obligation, though the appropriate basis depends on the specific context and jurisdiction. Organizations deploying proctoring platforms should confirm with their legal team which lawful basis applies to their specific program.

Integrity Advocate's data processing practices are designed to be compatible with whichever lawful basis your organization relies on, with data minimization and purpose limitation ensuring that processing remains within the boundaries of that basis.

Built for Global Privacy Compliance

GDPR is the most internationally recognized privacy framework and often sets the standard that other jurisdictions follow. Integrity Advocate is designed to support compliance across GDPR, PIPEDA, FIPPA, PIPA, POPIA, FERPA, CCPA, and the Victorian PDP Act simultaneously, with the same Privacy by Design architecture underlying each framework.

{{post-cta}}

When the COVID-19 pandemic forced higher education institutions to move assessments online almost overnight, most focused on one question: how do we stop cheating? The University College Dublin asked a better one: how do we make this work well for everyone?

The answer produced what UCD called a triple win: a proctoring outcome that served the institution, the students, and the faculty simultaneously. Here is how they got there.

The Challenge

UCD is Ireland's largest university, with over 33,000 students and a long-standing reputation for academic excellence. Maintaining that reputation meant that moving examinations online could not come at the cost of assessment integrity. But UCD also understood that how they proctored those exams would reflect directly on the student experience they were known for.

In-person examinations had always relied on physical controls: exam centers, invigilators, student ID checks at the door, and a clear prohibition on unauthorized materials or devices. Replicating that environment online without creating friction, privacy concerns, or an invasive experience for students was the core challenge.

UCD had additional considerations that many institutions overlook. They were unwilling to require students to install monitoring software on personal devices. They were concerned about the stress that aggressive proctoring creates. And they wanted a solution that would hold up to scrutiny on accessibility and privacy grounds.

The Approach: Looking at the Whole Assessment, Not Just the Monitoring

Rather than simply dropping a proctoring tool on top of their existing exam process, UCD worked with Integrity Advocate to look at the entire assessment lifecycle.

That meant evaluating the manner of assessment itself, not just the monitoring layer. It meant considering how questions were structured for a remote environment. It meant thinking carefully about student communication before, during, and after the exam. And it meant choosing a proctoring approach built on reasonable discretion rather than rigid algorithmic enforcement.

UCD also prioritized identity authentication from the start, replicating the student ID check that had always been part of in-person examination, but in a way that was proportionate and privacy-respecting for a home environment.

"Every flagged session at Integrity Advocate is reviewed by a trained human before any determination is made. The algorithm identifies. The reviewer decides. That's not a nice-to-have — it's the only way to produce outcomes programs can stand behind."

‍Chris Viso
‍Founder - My Food Service License

The Outcome: Less Than 2% Support Rate, Zero Complaints

The results were measurable and clear.

After completing online proctored assessments, Integrity Advocate gathered feedback from both students and faculty. The student-facing communication, combined with the use of reasonable discretion rather than automated algorithmic flags, produced an assessment experience where fewer than 2% of students reached out for support. There was not a single complaint received.

For a rollout of this scale, at one of Europe's largest universities, that is a remarkable outcome. It reflects what happens when the assessment experience is designed with the student in mind from the start, rather than treated as a control problem to be solved after the fact.

The Triple Win

The UCD implementation demonstrated that online proctoring done well does not require tradeoffs. It can deliver across all three dimensions simultaneously.

For the institution: Assessment integrity was maintained at the standard UCD's reputation demands. Results are documented, human-reviewed, and defensible.

For students: The experience was low-friction, privacy-respecting, and did not require installing software on personal devices. Students completed exams in a comfortable environment without unnecessary stress or invasive monitoring.

For faculty and administration: The process was manageable, support demand was minimal, and the transition did not create the operational burden that many institutions feared.

What UCD's Experience Means for Other Institutions

Since the shift to remote assessment during the pandemic, many higher education institutions have made online proctoring a permanent part of their strategy. The reasons are practical: reduced facility costs, greater scheduling flexibility, the ability to reach international students without travel constraints, and a more accessible experience for students who face barriers to in-person examination.

But the UCD experience points to something more important than logistics. The difference between a proctoring implementation that works and one that generates complaints, disputes, and staff burden comes down to approach.

Implementing online proctoring is not a simple process swap. It requires thinking about the impact on students, faculty, and administration from the start. It requires a partner willing to work through that process collaboratively, not just hand over a platform and step back.

That partnership is what UCD found with Integrity Advocate, and it is what made the difference.

{{post-cta}}

Integrity Advocate has completed SOC 2 Type II certification for the third consecutive year, with support from auditors at the Johanson Group and security partner Carbide.

SOC 2 Type II compliance represents an ongoing commitment to security, privacy, and the responsible handling of sensitive data. For partners, clients, and learners, it means the systems and processes protecting their information have been independently verified under real-world operating conditions, not just reviewed on paper.

What SOC 2 Type II Certification Involves

SOC 2 Type II is not a one-time audit. It is an extended review conducted over several months that evaluates how effectively an organization's security and privacy controls perform under actual operating conditions. The process includes defining security controls, implementing appropriate policies, conducting risk assessments, and continuously monitoring systems to ensure those controls hold up over time.

The Type II designation is significant. Where Type I confirms that controls exist at a point in time, Type II confirms that those controls operated effectively over an extended period. It is the higher standard, and the one that matters most to organizations evaluating a vendor's security posture.

Why Integrity Advocate Pursues SOC 2 Certification

SOC 2 Type II certification is commonly obtained by SaaS vendors to demonstrate effective security controls to enterprise clients and partners. At Integrity Advocate, the motivation goes further than that.

Data security is a responsibility, not a checkbox. Integrity Advocate handles sensitive data on behalf of clients every day, including government-issued ID images, biometric data, and session recordings. The people whose data this is should never have to wonder whether it is being handled securely. SOC 2 certification is one way of demonstrating that the answer is yes, backed by independent verification rather than self-assertion.

Trust is earned through consistent practice. SOC 2 Type II measures controls over time, not at a single moment. Achieving it three consecutive years reflects a sustained commitment to maintaining security standards as threats evolve, not a one-time effort to pass an audit.

Certification makes partnership easier. SOC 2 Type II is recognized across industries as a universal standard based on proven security practices. For organizations in higher education, professional certification, industrial training, and corporate learning evaluating a proctoring vendor, SOC 2 certification provides independent confirmation that Integrity Advocate's security controls meet the standard their own compliance teams require.

The Partners Behind the Process

Throughout the certification process, Integrity Advocate worked closely with auditors from the Johanson Group, whose expertise guided the audit with transparent communication and a shared commitment to rigorous standards. Integrity Advocate also leveraged Carbide as its security platform to support the process.

What This Means for Clients and Partners

For Integrity Advocate clients and partners, SOC 2 Type II certification is straightforward confirmation that the platform handling your learners' data meets independently verified security standards. It sits alongside Integrity Advocate's 12-plus years of operation with zero data breaches and 98% client retention as part of a consistent track record, not a single credential.

For more information about how Integrity Advocate handles data security and privacy, visit the Privacy page.

{{post-cta}}