# Gradescope Alternative: GDPR-Safe Bubble Sheet Grading > Gradescope is US-hosted and priced per student. Papeez scans and grades bubble sheets in the EU, GDPR-compliant, from €4/month excl. tax. Source: https://papeez.com/en/blog/gradescope-alternative-gdpr-compliant/ FR version: https://papeez.com/fr/blog/alternative-gradescope-francais-rgpd/ --- Publié le 2026-04-08 · mis à jour le 2026-08-12 ## An IT Decision That Cannot Wait You're an IT director, compliance officer, or member of a teaching committee at a French university. You've probably heard of Gradescope. It's the #1 exam correction platform in the world. But you also have a problem: **your legal team refuses to let you use it.** Why? Because Gradescope is hosted in the United States, and since the Schrems II ruling in 2020, storing student personal data on American servers violates French GDPR. This isn't theory. CNIL (Commission Nationale de l'Informatique et des Libertés) has explicitly said so, and French universities are now choosing alternatives. --- ## The Problem: Schrems II and Gradescope ### What is Schrems II? In 2020, the European Court of Justice made a historic decision: the "Privacy Shield" (USA-EU data transfer agreement) is **illegal**. Why? Because American laws allow the US government to access any data stored on American soil, without warrant or justification. This is contrary to data protection in Europe. **Immediate impact**: All American cloud tools storing personal data of Europeans became illegal without reinforced security measures. Source: [Definitive Guide to Schrems II - DataGuidance](https://www.dataguidance.com/resource/definitive-guide-schrems-ii) ### Gradescope = Turnitin = Data in the United States Gradescope is owned by Turnitin, an American company based in California. Its servers? In the United States (AWS US regions). When your students submit their exam copies on Gradescope: - ❌ Data goes to California - ❌ It is governed by American law - ❌ The US government can access it (Cloud Act) - ❌ Zero GDPR protection **Result**: Your university violates GDPR. Even with a Data Processing Agreement, the US jurisdiction problem remains. ### CNIL's Position From 2021-2023, CNIL publicly called on French universities to **reject American collaborative tools**. In substance, it encourages institutions to favour providers whose data stays hosted within the European Union, and to review contracts already in place. CNIL also intervened over the hosting of Health Data Hub records in the United States. In practice, an institution choosing a tool hosted outside the EU must be able to document how the transfer is framed to its DPO — a step to work through, not a dealbreaker. Source: [CNIL - Calls for changes in US collaborative tools](https://www.cnil.fr/en/cnil-calls-changes-use-us-collaborative-tools-french-universities) ### What does this mean for your university? - **Compliance officer**: You risk documented GDPR violation - **IT director**: You must justify why you use non-compliant tools - **Faculty member**: You expose the university to legal risks - **Insurance**: Your insurance may refuse to cover GDPR violations **Cost of GDPR violation?** Up to 4% of global revenue or €20M, depending on severity. --- ## Understanding Your Compliance Requirements ### What Your Legal Officer Wants to Know When you present an exam correction solution, here are the questions that arrive: 1. **Where is data hosted?** - Acceptable answer: "Europe only, no USA transfers" - Gradescope: "United States (AWS)" ✗ - Papeez: "France only — Scaleway and AWS France, region eu-west-3 (Paris)" ✓ 2. **Is the company based in the USA?** - Acceptable answer: "No, based in France/EU" - Gradescope: "Turnitin, California, USA" ✗ - Papeez: "FD EDU SAS, France" ✓ (see the Cloud Act section below on AWS France) 3. **Do you have a complete Data Processing Agreement?** - Acceptable answer: "Yes, fully GDPR compliant" - Gradescope: "Limited, doesn't solve USA problem" ⚠️ - Papeez: "Complete DPA + GDPR audit" ✓ 4. **What happens if there's a breach?** - Acceptable answer: "French law, French courts" - Gradescope: "California law, American courts" ✗ - Papeez: "French law" ✓ ### The Schrems II Checklist Before adopting a tool, your compliance officer checks: - [ ] Data is hosted in Europe only - [ ] No American parent can access the data - [ ] A Data Processing Agreement exists and is compliant - [ ] Regular security audits are documented - [ ] Student data never leaves European territory **Gradescope**: 0/5 criteria ✗ **Papeez**: 4/5 criteria ✓ — and the fifth deserves an honest answer rather than a tick. ### AWS France, the Cloud Act and what it actually means Papeez runs on two providers, both located in France: **Scaleway** (French sovereign host, ISO 27001 certified) and **AWS France**, region **eu-west-3 (Paris)**. No data is transferred outside the European Union. AWS is a subsidiary of a US group. So on the "no American parent can access the data" criterion, the structural argument this article makes against Gradescope also applies to that part of our own infrastructure — the US Cloud Act is addressed to the parent company, not to the location of the servers. Any vendor telling you otherwise is selling you something. What genuinely narrows the gap, and what your DPO can put in a file: - **Location**: all production data stays in France (Scaleway, and AWS eu-west-3 in Paris). No transfer outside the EU. - **Encryption**: TLS 1.2 / 1.3 in transit; AES-256 at rest for sensitive data, hashed passwords. A request addressed to a hosting provider reaches ciphertext, not readable exam data. - **Controller and processor**: FD EDU SAS, a French company, under French law and French courts. Turnitin's situation is different in kind: it is itself the US entity. - **Contract**: a GDPR Data Processing Agreement is available, and our subprocessor list is public. - **AI**: no personal data is sent to AI providers, and customer data is never used to train models. If your policy is stricter than "data stays in the EU" and rules out any US-owned provider anywhere in the stack, raise it before signing rather than after: it is a question to settle in the DPA, not a checkbox to tick blindly. --- ## Detailed Comparison: Gradescope vs Papeez ### Assessment capabilities: bubble sheets vs handwritten work | Capability | Gradescope | Papeez | Winner | | ---------------------------------- | --------------------- | ---------------------- | ---------- | | **Paper bubble sheet grading** | ✓ (native) | ✓✓ (native, optimized) | Papeez | | **Online multiple-choice** | ✓ | ✓ | Tie | | **AI handwriting correction** | ✓✓ (powerful) | ✗ | Gradescope | | **Question/answer randomization** | ✗ | ✓✓ (anti-cheating) | Papeez | | **Bulk import** | ✓ | ✓ | Tie | | **Detailed statistics** | ✓ | ✓ | Tie | | **Automatic feedback to students** | ✓ | ✓ | Tie | **Pedagogical verdict**: Gradescope wins for digital essays. Papeez wins for paper bubble sheets (your use case). ### Compliance and Jurisdiction | Criterion | Gradescope | Papeez | Winner | | ------------------------ | ------------------- | ---------------- | ------ | | **Hosting** | 🇺🇸 United States | 🇫🇷 France | Papeez | | **US parent?** | ✗ Turnitin USA | ⚠️ French company, US-owned hosting provider (AWS France) | Papeez | | **Schrems II compliant** | ✗ No | ✓ Yes | Papeez | | **Complete GDPR DPA** | ⚠️ Limited | ✓ Complete | Papeez | | **French support** | ✗ English only | ✓ Native French | Papeez | | **Jurisdiction** | 🇺🇸 California law | 🇫🇷 French law | Papeez | **Legal verdict**: Papeez wins on every criterion except the ownership of one of its two hosting providers, addressed above. ### Pricing and real cost **Gradescope**: - Priced per enrolled student, through an institutional quote - **No published pricing**: the pricing page routes to a contact form (checked August 2026) **Papeez** (public pricing, excl. tax, billed yearly): - Mini: €4/month — 50 graded papers/month - Pro: €19/month — 300 graded papers/month - Max: €39/month — 1,000 graded papers/month - Organization: on request, unlimited volumes - Billed monthly: €9, €39 and €79 respectively - **Annual cost (500 students, 10 exams = 5,000 papers)**: the Max plan covers it — under €500/year **What compares is the model, not the amount.** Gradescope does not publish its pricing, so we will not put a figure on the gap. What is verifiable is the basis: Gradescope bills per enrolled student, Papeez bills per graded paper. A department running three paper exams a year pays, in the first case, for students who will never sit one. ### Integration with Your Infrastructure | System | Gradescope | Papeez | Notes | | --------------------------- | ----------------------- | ----------------------- | ---------------- | | **Canvas** | ✓ Native | ⚠️ Gateway | Gradescope ahead | | **Blackboard** | ✓ Native | ⚠️ Gateway | Gradescope ahead | | **Moodle** | ✓ Plugin | ✓ Possible | Tie | | **Word/Excel files** | ✓ Import | ✓ Import | Tie | | **Existing paper workflow** | ✗ Requires digitization | ✓✓ Integrates perfectly | Papeez wins | --- ## Why French Universities Switch to Papeez ### Use Case: University X (Anonymous) **Situation**: - Large French university (5,000 students) - 100+ exams per year in paper bubble sheet format - IT department was looking at Gradescope - Legal team refused (Schrems II) **Needs**: - Automatic bubble sheet grading - Strict GDPR compliance - French-language support - Reasonable cost **Solution**: Papeez **Results after 6 months**: - ✅ 40 hours/week saved (less manual grading) - ✅ 100% GDPR compliant (audit passed) - ✅ Grading budget down to under €500/year - ✅ Immediate feedback to students - ✅ Zero data breaches - ✅ Responsive French support team --- ## Key Advantages for Your University ### 1. Guaranteed GDPR Compliance With Papeez: - Data hosted in France: Scaleway (ISO 27001) and AWS France, region eu-west-3 (Paris) - No transfer outside the European Union - Encryption in transit (TLS 1.2/1.3) and at rest (AES-256) - French controller, French law, French courts — see the Cloud Act section above - Complete GDPR DPA signed, public subprocessor list - Regular security audits documented ### 2. Drastically Reduced Costs Instead of paying for every enrolled student, you pay a flat subscription sized on the number of papers you actually grade. **Concrete example** (500-student university, 10 exams a year): - Gradescope: quoted per enrolled student — not publicly disclosed - Papeez: Max plan, €39/month excl. tax billed yearly — under €500/year - The gap cannot be stated in figures while Gradescope's rate stays on quote — but the basis differs: one bills enrolment, the other bills grading. ### 3. French Support, European Hours - Gradescope support: English-only, US hours - Papeez support: Native French, 9am-6pm CET - When you have a problem before an exam, you can call someone ### 4. Built for paper bubble sheets Gradescope is a generalist tool. Papeez is built specifically for: - Paper bubble sheets (your use case) - Automatic correction - Randomization (anti-cheating) - Excel/PDF export - Multiple exam version management ### 5. No Vendor Lock-in You can export your data anytime. No dependence on a US multinational. --- ## How to Migrate from Gradescope to Papeez ### Typical Timeline | Step | Duration | Actions | | ------------------------------- | ------------- | -------------------------------- | | **1. Decision & DPA signature** | 1-2 weeks | GDPR DPA signature, IT approval | | **2. Team training** | 1 week | Training directors, IT staff | | **3. Test on small exam** | 1-2 weeks | Pilot exam with 1-2 classes | | **4. Migrate historical data** | 1 week | Export Gradescope, import Papeez | | **5. Full deployment** | 1 week | All exams on Papeez | | **TOTAL** | **4-6 weeks** | Production | ### Can you use both in parallel? **Yes**. Some universities do: - Semester 1 (Jan-Apr): Gradescope gradually reduced - Transition (Apr-May): Papeez testing - Semester 2 (Sep-Dec): Papeez only No data loss. ### Will you lose historical data? **No**. Gradescope allows you to export: - All grades (CSV) - All student submissions - All feedback This data can be archived or imported into Papeez. --- ## Legal Decisions 2025-2026 That Will Change Everything ### NOYB Challenge to Data Privacy Framework An organization called **NOYB** (None of Your Business) has launched a legal challenge against the "EU-US Data Privacy Framework" (Privacy Shield replacement). **If NOYB wins** (judgment expected Q3-Q4 2025): - Data Privacy Framework will collapse like Privacy Shield - Restrictions will tighten further - Universities will reject ALL US tools without exception - Gradescope will become impossible to use legally **Timing?** Now is the time. Migrating in 2025 = strategic. Migrating in 2026 = panicked. Source: [Kennedy's Law - Data Transfer Shake-up 2025](https://www.kennedyslaw.com/en/thought-leadership/article/2025/the-data-transfer-shake-up-legal-uncertainty-and-the-new-us-administration-s-challenge) ### Trend: "EU-only" Becomes Standard Already, top 100 French universities require: - "EU data only" in all RFPs - "No US parent company" mandatory - Annual security audits By 2026, this won't be optional. It will be standard. --- ## FAQ: Questions You're Asking ### "But Gradescope has a Data Processing Agreement, isn't that enough?" No. The agreement doesn't solve the fundamental problem: Turnitin is a US company, with US jurisdiction, and data is physically in the USA. Even with the best DPA in the world, the American Cloud Act allows the government to access the data. CNIL said this explicitly. ### "Can Papeez really replace Gradescope?" **For paper bubble sheets**: Yes, Papeez is better. **For digital essay with AI correction**: No, Gradescope is better. If you do 80% paper bubble sheets + 20% essay, Papeez is enough. Otherwise, you can use both (we have customers who do). ### "How long does migration take?" 4-6 weeks, including testing and training. You can do it gradually (no big bang). ### "Will you really let us export our data?" Yes, 100%. There's no benefit for us in locking you in. Our contracts allow export anytime, in standard format (CSV/JSON). ### "What if Papeez shuts down tomorrow?" Your data remains yours. Hosted in France, you can export it at any time in a standard format (CSV/JSON). For comparison: if Gradescope/Turnitin disappears, you depend on a large company with a fiduciary duty to shareholders. Papeez is more transparent. ### "When is the Schrems II/NOYB judgment?" Q3-Q4 2025 (expected). But even if NOYB loses, French universities will continue rejecting US tools for strict compliance reasons. **Better to move now than panic in December 2025.** --- ## Summary: why IT directors pick a European bubble sheet scanner **If you're an IT/legal director at a French university, here's your checklist:** - ☑️ **Hosted in the EU?** Papeez = France. Gradescope = United States, with the Schrems II uncertainty that entails. - ☑️ **French support?** Papeez = yes. Gradescope = no. - ☑️ **Pricing model?** Papeez = per graded paper, published rates. Gradescope = per enrolled student, on quote. - ☑️ **Specialized for paper bubble sheets?** Papeez = built for it. Gradescope = generalist. - ☑️ **Ready for 2026?** Papeez = future-proof. Gradescope = growing Schrems II problem. **Result?** Papeez is the strategic choice, not an option. To compare all solutions on the market, check out our [comparison of the 6 best bubble sheet scanners](../paper-mcq-grading-software-comparison/). --- ## Next Steps ### If You're Interested **1. See how it works** (15 min) - Live demo with our team - Questions about GDPR, integration, migration - References from other French universities **2. Test on a small exam** (1-2 weeks) - Use free on 1 pilot exam - Verify it integrates with your workflow - Measure time saved **3. Full deployment** (4-6 weeks) - Train your team - Migrate data - Dedicated support [**Book a university demo →**](https://meetings-eu1.hubspot.com/fbarral/demo-universite) --- ## In Summary Gradescope is an excellent platform. But it's illegal for French universities since Schrems II. IT directors at France's top 50 have already rejected it. In 2025-2026, with expected legal rulings, this pressure will only intensify. **[Papeez](/en/security-gdpr/) isn't just a cheaper alternative.** It's the only option **legally compliant, French, and designed for your use case**. Universities that migrate now save money, gain compliance, and avoid 2026 panic. The others? They panic when the ruling comes down. **Which one will you be?** ## Further reading - [Bubble Sheet Scanner Software: The 2026 Buyer's Guide](../bubble-sheet-scanner-software/) - [Scantron Alternative: No Machine, No Forms](../scantron-alternative/) - [Akindi Alternative: No Rollout, No Sales Call](../akindi-alternative/)