Built to pass a security review, and to protect students’ data every day.
Exams and student work are some of the most sensitive data an institution holds. This page sets out how Tomax protects it, in the order a procurement or security team usually asks.
- ISO 27001Information security management
- ISO 27017Cloud security controls
- ISO 9001Quality management
- SOC 2Security and data-handling controls
- GDPREU data protection law
- FERPAUS student education records law
Your Data
Encrypted, logged and kept where you need it
Encrypted and logged
Data is encrypted in transit and at rest, and access is logged.
Stored in your region
Regional data residency keeps exam data in the jurisdiction your institution or regulator requires.
Built on AWS
Tomax uses Amazon Web Services, with all the relevant protections of AWS applied to your data.
Who Can See It
Access is separated, signed in and recorded
Separate permissions
Who can see a paper, who can approve it, and who can change a result are separate roles, not one administrator account, with role-based access down to individual exams.
Single sign-on
SAML and OAuth 2.0, so staff and students use their existing institutional credentials.
No routine access for Tomax staff
Support engineers access data only when your institution requests it, and every access is logged.
Exam Integrity
Custody of the paper, from authoring to results
Chain of custody
Every action on the paper is timestamped and attributable, from authoring to release of results.
Sealed papers
Review and approval are recorded before a paper is sealed, so authoring, approval and release sit with different roles.
Recorded exceptions
Every override names who granted it and why.
Secure delivery
A lockdown browser with identity verification at login, and live monitoring for exams that need it.
Privacy
Students and institutions stay in control
Never sold, never trained on
Student work and session data are not sold, shared with advertisers, or used to train commercial AI models.
Your institution sets retention
Retention is enforced to your policy, and recordings can be deleted automatically based on your institution's configuration.
A person decides
Tomax surfaces anomalies for review. An integrity decision is never made automatically: a human at your institution always reviews and decides.
Student rights
Students can ask what is held about them, have errors corrected, ask for erasure once retention and appeal periods have passed, object to processing, and contest a flag.
VivaGo recordings are stored encrypted and covered by the same policy. Read the full detail in the student privacy page and the privacy notice.
For Procurement
Documentation for your security review
Full documentation is available for procurement and security review. Ask your Tomax contact, or write to us and we will send it.
- Security and sales questions
- sales@tomax.io
- Privacy requests
- privacy@tomax.io
Common questions
Tomax is ISO 27001, ISO 27017 and ISO 9001 certified, and complies with SOC 2, GDPR and FERPA. Full documentation is available for procurement and security review.
Tomax supports regional data residency, so your institution can require that exam data stays in a specific jurisdiction. Tomax uses Amazon Web Services, with the relevant AWS protections applied.
No. Student work and session data are not sold, shared with advertisers, or used to train commercial AI models.
No one routinely. Support engineers access data only when your institution requests it, and every access is logged.
Yes. Your institution sets the retention rules, and recordings can be deleted automatically based on its configuration.
Yes. Tomax supports single sign-on through SAML and OAuth 2.0, alongside LTI 1.3 and a RESTful API for LMS and SIS integration.
Need our security documentation?
Talk to the team. We will walk through how Tomax handles your data and send what your review needs.
Request a Demo