TenGrade Privacy Policy

Last updated: 30 September 2026

TenGrade is a product of Fibtec Limited, a company registered in England and Wales under company number 07098379, with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“Fibtec”, “we”, “us”).

This policy explains what personal data TenGrade collects, why, and what your rights are. It covers two very different groups of people, because TenGrade is built to treat them very differently:

• Examiners — the people and organisations who hold TenGrade accounts, build exams, and review results. For this group, Fibtec is the data controller.
• Candidates — the people who take exams through TenGrade. For this group, the examiner organisation is the data controller, and Fibtec acts as a data processor on their behalf, under a data processing agreement (available on request — see §9).

If you’re a candidate with a question about your exam data, the organisation that invited you to take the exam is who to contact first — we act on their instructions, not independently, for your data.

1. Who this applies to, and TenGrade’s core design choice

TenGrade is built around one deliberate architectural decision: a candidate is never asked for, and the system never stores, personally identifying information — no name, no email address, no CV. Each exam attempt is identified only by a randomly generated identifier, and the examiner never sees anything else. This isn’t a policy promise layered on top of an ordinary system — it’s how the underlying software is built, and this policy describes exactly what that means and where its edges are.

2. Personal data we collect about examiners

If you create a TenGrade account (as an Owner, Examiner, or Auditor for your organisation), we collect:

• Your email address — used as your login identity and to determine which organisation you belong to.
• Your role within your organisation (Owner, Examiner, or Auditor).
• Authentication data held by our identity provider (a securely hashed password, and an optional two-factor authentication secret if you enable it) — this is held by our authentication infrastructure, not duplicated in our own application database.
• Billing information, if your organisation makes a payment — see §5.

We do not collect your name, phone number, or physical address at any point in the examiner sign-up or account-management flow. If you sign in via Google or Apple (where enabled), those providers share your email address with us to link the sign-in to your existing account — we don’t request anything beyond that.

3. Personal data we collect about candidates

We do not collect a candidate’s name, email address, CV, or any other directly identifying information, by design. A candidate accesses an exam via a unique link containing a randomly generated token; that token — not any personal detail — is the only thing that identifies their attempt. The token is deliberately carried in a part of the web address that is never transmitted to our servers’ access logs.

What we do store, tied to that anonymous identifier, is the content of the exam attempt itself:

• The candidate’s written, coded, or mathematical answers, as text.
• If the exam uses diagram/image answers: the uploaded image file. Embedded metadata a device may have attached to the file (such as location or device information) is automatically stripped shortly after upload, before the image is used for grading — only the image content itself is retained.
• Scores, grading justification text, and (if enabled) a webcam-proctoring trust score and flagged-event summary — see §4.
• If your exam session uses optional webcam-based proctoring, further detail on exactly what that vendor sees is in §4.

None of this content is ever linked back to a real-world identity by TenGrade’s own systems. The examiner organisation that invited you may, of course, separately know who was given which exam link through their own records outside TenGrade — that’s between you and them, not something TenGrade holds.

3.1 A discretionary exception, stated plainly

Fibtec keeps an internal technical mapping between an exam’s anonymous identifier and the underlying record, as an operational necessity of running the platform. Under exceptional circumstances only — a legal obligation (such as a court order), a good-faith suspicion of fraud, or a genuine investigation into the integrity of the platform — Fibtec may use this mapping and disclose what it reveals. This is not something we do as a matter of course, and it is not something an examiner organisation can request on demand; it is a narrow, exceptional safeguard, not a backdoor into candidate anonymity. Full detail on when and how this applies is in our Terms of Service.

4. Optional webcam / AI proctoring (ProctorSafe)

If an examiner organisation enables webcam-based exam integrity monitoring, a candidate’s browser communicates directly with our proctoring partner, ProctorSafe — their video and audio never pass through TenGrade’s own servers at any point.

What ProctorSafe shares back with TenGrade is limited to: a trust score (a number), a count and summary of flagged events, session duration, and — if a human review is triggered — the outcome category of that review (e.g. a technical fault, a false positive, or an approved accommodation). Raw video or audio content is never sent to TenGrade.

By default, ProctorSafe is configured to operate in events-only mode — meaning no video frames are retained by ProctorSafe at all, only the scored events described above. This setting is a deliberate operational choice we maintain, not an assumption about default vendor behaviour, and it’s what keeps a candidate’s anonymity intact even when this optional feature is turned on.

ProctorSafe is based in the EU and uses its own sub-processors to provide this service: Amazon Web Services (hosted in Paris, France) for infrastructure, and Mistral AI (based in France) for automated session analysis — Mistral only ever receives anonymised, compressed event timelines, never video or audio. ProctorSafe retains session data for up to 30 days on a rolling basis; under ProctorSafe’s own data processing terms, all data is deleted within 12 months of contract termination or a deletion request, whichever is sooner.

5. Payment data

If your organisation purchases credit, payment is handled entirely by Stripe, our payment processor. We never see or store your card number, expiry date, or security code — Stripe’s own hosted checkout collects this directly. We only ever store the amount charged, the resulting credit balance, and a reference to the transaction, so we can show your organisation its own billing history.

6. Grading — what we share with our AI provider

To grade an answer, TenGrade sends the question, the target/reference answer, and the candidate’s own answer (as text, or as an image for diagram answers) to Anthropic, the company that provides the Claude AI models TenGrade uses for grading, AI-assisted question drafting, and generating the narrative review text on a report. Because candidates are never identified to TenGrade in the first place (§3), no candidate name or other identifying detail is ever included in what’s sent — only the exam content itself.

One tier-specific disclosure worth knowing about: if an examiner organisation chooses TenGrade’s Premium grading tier (which uses Anthropic’s Opus or Fable models rather than the Standard tier’s Sonnet model), Anthropic applies its own standard 30-day data retention policy for safety-monitoring purposes to those specific calls. This doesn’t affect a candidate’s anonymity — no identifying information is in the graded content regardless — but it is a genuinely different retention period from our Standard tier, and we disclose this to the examiner organisation directly in the exam-building interface before they choose that tier.

7. Cookies and tracking

TenGrade does not use cookies, and we do not run any analytics or tracking software on any of our sites or applications — no Google Analytics, no advertising pixels, nothing of that kind, anywhere. This isn’t a preference setting you need to opt out of; it simply isn’t built into the product. Where we use browser storage at all, it’s limited to what’s strictly necessary to keep an examiner’s account signed in — never for tracking, profiling, or advertising.

8. How long we keep data, and your rights

Our audit posture is that exam records, results, and billing history are never deleted automatically by our own systems, once created — this is a deliberate integrity guarantee: an examiner’s own past results and reports remain reliably available, and (for organisations that choose our optional blockchain-anchoring feature) an anchored result’s record cannot be altered after the fact.

If you are an examiner, your organisation’s Owner can request full, permanent deletion of your organisation and all of its data — every exam, every result, every member account, and billing history — directly through our platform’s API, at any time, without needing to contact us first. This is a genuinely irreversible action: once confirmed, everything is permanently removed (see our Terms of Service §8 for exactly what this does and does not affect). If you are a candidate who wants to understand what is held about a specific exam attempt, or need help with a request, contact us at info@fibtec.co.uk and we will assist directly — candidates do not have a separate self-service option today, since we never hold any information that identifies you in the first place (§3). Under UK GDPR you have the right to access, correct, or request erasure of your personal data, to object to or restrict our processing of it, and to data portability; the same email address is the way to exercise any of these rights, and if you’re not satisfied with our response you have the right to complain to the UK Information Commissioner’s Office (ico.org.uk).

9. Where your data is hosted, and who else sees it

TenGrade’s own infrastructure runs entirely in Amazon Web Services’ Ireland (eu-west-1) region — your data does not leave the EU/UK by virtue of our own hosting. Where we use other companies to help run the service (our “sub-processors”), here’s the full list and what each one sees:

If your organisation needs a formal Data Processing Agreement covering candidate data (since we act as your processor for that data — above), contact us at info@fibtec.co.uk and we’ll provide one.

10. Changes to this policy

We’ll update the date at the top of this page whenever this policy changes, and for material changes, we’ll make reasonable efforts to notify account holders directly.

11. Contact us

General product and support questions: info@tengrade.co.uk
Privacy rights, data requests, and Data Processing Agreements: info@fibtec.co.uk

Fibtec Limited
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ