Privacy
Exactly what is collected, what never is, and the consent record that has to exist before any of it happens.
6 min read
Proctor monitors an interview the candidate agreed to be monitored in, for as long as it lasts, and no longer. This page is the specific version of that sentence: the scopes, the wording, the exclusions, and how long anything is kept.
Consent comes first, and it is enforced
Before a single frame, event or byte of audio is captured, the server must hold a consent record for that session naming the exact scopes. Until it does, the ingest API refuses writes. The consent screen shows the scopes in plain language and asks the candidate to agree to this statement:
"I agree that this application will monitor only the information described below during this interview."Two scopes are required for any session to run — screen_recording and running_interview_application_status. Every other scope is optional, gated by your organization's policy as well as the candidate's agreement, and off unless deliberately enabled.
Every scope, and what it covers
| Scope | What it collects | Required |
|---|---|---|
screen_recording | Images of the screen the candidate shares — screenshots and recorded segments. | Yes |
running_interview_application_status | Whether the interview application itself is running and focused. Not a list of other applications, and not their names. | Yes |
microphone | Microphone audio, and the transcript produced from it. | No |
microphone_availability | Whether a microphone exists and is enabled — a device check, not audio. | No |
camera_availability | Whether a camera exists and is enabled — a device check, not video. | No |
companion_video | Side-view video from a phone paired to the session and stood beside the desk. | No |
screen_text | Text recognised on the captured screen leaving the device. Recognition runs locally; without this scope the text never leaves the machine. | No |
system_audio | What the machine plays through its speakers, captured separately from the microphone and never mixed with it. It is not transcribed. | No |
What is never collected
These are not settings that default to off. The agent has no code path that transmits any of them, and every phase of development re-audits the actual wire traffic against this list.
- Keystrokes. No keylogging, in any mode, ever.
- Window titles and filenames, and the URLs of anything the candidate has open.
- A software inventory. The agent reports whether the interview application is running and focused — not what else is installed or open.
- Identity or biometric templates. Face detection answers "is someone there" and "is there more than one person", and produces no face signature, no identity, and no match against any database.
- Anything at all outside a session. The agent does not run between sessions.
Monitoring is always visible
While a session is live the candidate sees a banner in the application and an indicator in the menu bar or system tray. There is no background mode, no silent mode, and no configuration that removes the indicator — including for administrators.
How long evidence is kept
Retention is set per organization, and a session can be given a shorter window than the organization's default but never a longer one than the plan permits. New organizations start at 7 days. When a window expires the evidence is deleted, not archived.
- 7 days
- 30 days
- 90 days
- 365 days
- Indefinite — available on plans that permit it, and a deliberate choice rather than a default.