Your exam papers, hosted and encrypted in France
Exam data is hosted exclusively in France, on Scaleway (ISO 27001 certified) and AWS region eu-west-3 in Paris. TLS 1.2/1.3 in transit, AES-256 at rest. No personal data is sent to any AI provider. Data controller: FD EDU SAS, SIREN 884027079, under French law.
Key facts
- Exam data is hosted exclusively in France, on Scaleway (ISO 27001 certified) and AWS eu-west-3 region (Paris); no exam data is transferred outside the European Union.
- Encryption is TLS 1.2/1.3 in transit and AES-256 at rest; passwords are hashed.
- No personal data is sent to OpenAI or any other AI provider; AI calls carry question text and MCQ structure only.
- The data controller is FD EDU SAS (SIREN 884027079), under French law; a GDPR request is answered within 30 days.
- A GDPR-compliant Data Processing Agreement (DPA) is available, along with the public list of sub-processors.
Where is exam data hosted?
Exam data (papers, scanned answer sheets, candidate identities, grades) is hosted exclusively in France, on Scaleway and AWS France (eu-west-3 region, Paris), two certified providers. No exam data ever leaves the European Union. The papeez.com marketing site itself is served by Cloudflare and processes no exam data at all.
How is data encrypted?
All customer data is encrypted in transit and at rest. Traffic goes over HTTPS with TLS 1.2 or 1.3, with no exception. Sensitive data at rest is encrypted with AES-256, and passwords are hashed, never stored in clear text. Layer by layer:
- In transit: HTTPS protocol (TLS 1.2 / TLS 1.3) across all traffic
- At rest: AES-256 encryption for sensitive data, hashing for passwords
How is the infrastructure protected?
The infrastructure follows a defense-in-depth approach: every service runs behind Cloudflare (DDoS protection, rate limiting), inside a virtual private cloud with a firewall. Server access goes through SSH keys, restricted to authorised team members, and software component vulnerabilities (CVE) are monitored automatically.
- All services run behind Cloudflare (built-in DDoS protection, rate limiting)
- Virtual private cloud (VPC) with firewall controlling inbound and outbound traffic
- Server access limited to authorized team members via SSH key (no password)
- Automated monitoring for software component vulnerabilities (CVE)
- Team trained on OWASP Top 10 vulnerabilities — regular code and infrastructure audits
What does Papeez do with your data and AI?
Papeez uses OpenAI's artificial intelligence to speed up certain features, such as exam import. No personal data is sent to OpenAI or any other provider: the calls carry question text and MCQ structure only. Your data is never used to train models.
- No personally identifiable customer data is ever sent to OpenAI or any other third-party AI provider
- Your data is never used to train AI models
- AI calls are limited to non-personal content (question text, MCQ structure)
Who are Papeez's sub-processors?
Papeez shares your data only with the partners strictly necessary to deliver the service: the hosting providers named above, and the AI provider, limited to non-personal content. The full list, with the role of each one, is published and can be consulted at any time. View the full list of our sub-processors
Do you offer a Data Processing Agreement (DPA)?
Yes. Papeez offers a GDPR-compliant Data Processing Agreement that defines the respective responsibilities for the protection of personal data. A signed copy, to file with your own compliance records, can be obtained through the contact form. The public sub-processor list above complements it.
To obtain a signed copy, contact us.
Is Papeez GDPR compliant?
Yes. Papeez applies the General Data Protection Regulation: only the data necessary to deliver the service is processed, your rights of access, rectification, portability and deletion are guaranteed, no data leaves the European Union, and any breach is notified to the competent authorities. Our commitments:
- Processing only data strictly necessary to deliver the service
- Guaranteeing your rights of access, rectification, portability and deletion
- Never transferring any data outside the European Union
- Notifying competent authorities in the event of a data breach
To exercise your rights or for any question regarding your data, contact us.
Data protection contact: pre-filled contact form — FD EDU SAS, data controller. Response within 30 days, as required by the GDPR.
Frequently asked questions
Exclusively in France: on Scaleway, an ISO 27001 certified provider, and on AWS in the eu-west-3 region (Paris). No exam data, whether papers, scanned sheets, identities or grades, is transferred outside the European Union.
Yes. All traffic goes over HTTPS with TLS 1.2 or 1.3. At rest, sensitive data is encrypted with AES-256 and passwords are hashed. Services run behind Cloudflare, inside a virtual private cloud with a firewall, with server access through SSH keys only.
No. Papeez uses OpenAI's AI for some features, such as exam import, but no personal data is sent to OpenAI or any other provider. The calls carry question text and MCQ structure only, and your data never trains a model.
The data controller is FD EDU SAS (SIREN 884027079), a company under French law. You exercise your rights of access, rectification, portability and deletion through the contact form, reason "Data deletion request". Answer within 30 days, as the GDPR requires.
Yes. A GDPR-compliant DPA, which sets the respective responsibilities for personal data, is obtained signed through the contact form, reason "Data Processing Agreement". The full list of sub-processors is published and linked from the Security & GDPR page.
No. The papeez.com marketing site is served by the Cloudflare CDN and neither processes nor stores any exam data. The Papeez application and exam data are hosted separately, in France, on Scaleway and AWS (eu-west-3 region, Paris).
Through defense in depth: Cloudflare DDoS protection and rate limiting, a virtual private cloud with a firewall on inbound and outbound traffic, server access restricted to authorised team members through SSH keys, automated monitoring of component vulnerabilities (CVE) and a team trained on the OWASP Top 10.
No. Papeez grades paper MCQs. Computer-based exams, open-ended questions and proctoring belong to Evalmee, the online assessment platform built by the same team, with its own security page: evalmee.com.