Skip to content
- What we store. The documents you send; what we read from them (questions, answer keys and students’ answers); marks, feedback and reports; and the student details you send:
student.external_id and, if given, student.name.
- Send as little personal data as you can. We don’t need students’ names, email addresses or dates of birth. Use a pseudonymous
student.external_id; student.name is optional and appears only on the report. Keep personal data out of metadata and file names, and cover names on scripts where you can.
- Who can see it. Your data is visible only to your own API keys, in the mode it was created in, and to the reviewers you send review links to. Stored documents are private: upload and report links are pre-signed and expire.
- In transit. All traffic uses TLS.
- Deletion. You can delete a submission or a paper once nothing in it is
queued or processing. Its documents, results and reports are deleted with it, and it is removed at the same time from stored events and saved idempotent responses: an event about it keeps its type and time, and its data.object becomes { "id": "…", "object": "submission", "deleted": true } (or "paper"). A file that a failed or cancelled submission released for reuse is yours again, so it isn’t deleted with that submission. Deleting a student’s last submission deletes their student.external_id too. Your credit transactions keep the id of a deleted paper or submission in source, so your charges still reconcile. Deleted data leaves our backups within 30 days. Files you never use are deleted after 24 hours.
- Retention. We keep your data until you delete it or your agreement ends.
- Your agreement and our privacy policy set out what happens when an agreement ends, where data is stored and processed, which subprocessors we use, and how we use data.
