Security & Compliance
How we protect student data, by design, not by promise.
Privacy & Security at ExamLock
ExamLock is engineered to give Australian schools a powerful exam-integrity and classroom phone-management tool, without ever holding student identities on our servers.
Students have no accounts, no names, no emails, and no passwords inside ExamLock. A student is known to our system only by their school-issued student number and an anonymised device fingerprint. Their real identity stays inside the school's own Student Information System, where it belongs.
This is not a policy promise. It is how the platform is built.
Built on three principles
Australian sovereign
All data is hosted in AWS Sydney. Nothing crosses a border. Aligned with NSW Department of Education hosting expectations.
No student PII
We never collect names, emails, phone numbers, locations, photos, contacts, or browsing history. We can't leak what we don't hold.
Platform-native locking
Apple's Automatic Assessment Configuration on iOS and app-overlay enforcement on Android, the same approach used by major standardised testing platforms.
Privacy by Design
Most platforms protect student data with policies. ExamLock protects it with architecture.
Every student record on ExamLock is pseudonymous. A student number on its own, such as STU-20481, is meaningless outside the school that issued it. The device fingerprint is stored as a one-way cryptographic hash that cannot be reversed back into a device. The link between a student number and a real person exists only inside the school's own systems.
What this means in practice
Schools keep full ownership of student identity. ExamLock holds only the operational data needed to run an exam session: timestamps, lock state, and the events that prove integrity. Nothing more.
Where Student Data Lives
ExamLock's data boundaries are explicit. Schools always know what we hold, what we never collect, and what remains inside their own systems.
| Held by ExamLock | Never collected | Stays inside the school |
|---|---|---|
| Anonymised device fingerprint | Student names | Student number ↔ real identity mapping |
| Student number | Email addresses | Contact details |
| School ID | Phone numbers | Parent or guardian information |
| Session timestamps (check-in, lock, unlock) | Date of birth | Medical or welfare records |
| Phone lock state during a session | GPS or location data | |
| Platform and OS version | Photos, contacts, files | |
| Exam session events | Browsing history, biometrics |
How Phone Locking Works
ExamLock relies on the lockdown technology built into iOS and Android themselves, not on installing managed device profiles or taking control of student phones.
- iOS: Apple's Automatic Assessment Configuration (AAC), the same official exam-lockdown API used by major standardised testing platforms worldwide.
- Android: Application-level overlay enforcement that activates during a session and releases the device the moment the session ends.
ExamLock is dormant outside of active sessions. There is no background monitoring, no listening, no profile that persists when the exam is over.
What ExamLock will never do
- Install MDM profiles or enrol devices.
- Read SMS, call logs, or contacts.
- Track student location.
- Access the camera or microphone in the background.
- Read files, photos, or browsing history.
- Collect any data outside an active exam or class session.
Australian Privacy Principles
ExamLock is aligned with all 13 Australian Privacy Principles under the Privacy Act 1988 (Cth).
| APP | Principle | How ExamLock meets it |
|---|---|---|
| 1 | Open & transparent management | Public privacy policy and this document set out our approach openly. |
| 2 | Anonymity & pseudonymity | Pseudonymous by architecture: student numbers only, no names or personal identifiers. |
| 3 | Collection of solicited information | Minimal collection: student number, anonymised device hash, and exam timestamps. No PII collected. |
| 4 | Dealing with unsolicited information | No mechanism exists for unsolicited personal information to enter the system. |
| 5 | Notification of collection | Privacy policy available at examlock.me/privacy and surfaced inside the app. |
| 6 | Use or disclosure | Data is used solely for exam integrity. No third-party sharing, no marketing, no analytics on student data. |
| 7 | Direct marketing | Student data is never used for marketing. No communications are sent to students. |
| 8 | Cross-border disclosure | All data is hosted in AWS Sydney (ap-southeast-2). No cross-border transfer. |
| 9 | Government identifiers | Student numbers are school-assigned, not government identifiers. |
| 10 | Quality of personal information | Schools manage student number accuracy through their own Student Information System. |
| 11 | Security of personal information | Industry-standard encryption in transit and at rest, role-based access controls, rate limiting, and encrypted credential storage on mobile devices. |
| 12 | Access to personal information | Schools can export or request all data associated with their school ID at any time. |
| 13 | Correction of personal information | Schools update student records at source; students can request correction through their school. |
Built for Australian Schools
ExamLock is designed around the legal and policy environment Australian schools actually operate in.
| Requirement | How ExamLock meets it |
|---|---|
| PPIP Act 1998 | Student data is pseudonymous; no personal information as defined under the Privacy and Personal Information Protection Act is stored on ExamLock servers. |
| NSW DoE hosting requirements | All data is hosted in AWS Sydney (ap-southeast-2), meeting Australian data sovereignty requirements. |
| HRIP Act 2004 | No health records are collected or stored. |
| Children's Online Privacy Code (OAIC, December 2026) | ExamLock's architecture already exceeds the expected requirements: no student PII stored, pseudonymous by default, minimal data collection. |
Talk to Us
Schools, IT departments, and Department evaluators are welcome to request a deeper technical brief covering our infrastructure, controls, and audit posture.