Advanced Video Proctoring: data handling reference_
What Codility’s Advanced Video Proctoring captures at each level, how it is processed, where it lives, how long it is retained, who can access it, and which compliance credentials apply. Written for security and compliance reviewers evaluating Codility.
Summary answers
The questions raised most often in security questionnaires. Detail and rationale follow in the sections below.
| Question | Answer |
|---|---|
| What is captured at Level 2 | Periodic webcam snapshots and periodic screen snapshots taken throughout the assessment. No audio. |
| What is captured at Level 3, Advanced | Continuous recording of the candidate’s webcam, continuous recording of the candidate’s screen, and continuous recording of the candidate’s audio for the full session. |
| Where is it stored | On Codility-managed infrastructure, encrypted at rest. Access is limited to authorized reviewers in the customer’s account. |
| Default retention | 30 days for all proctoring artifacts at every level. After 30 days the data is deleted. |
| Can retention be shortened today | A shorter retention window can be configured through Codility support. Self-serve, customer-defined retention is in development on the near-term roadmap. |
| Does Codility use a sub-processor for proctoring | Not for storage. Recordings are stored on Codility-managed infrastructure. For session recording and media processing, Codility uses Twilio as a sub-processor. Recordings are transferred to Codility’s environment for retention. |
What each level captures
Two operating modes. The level configured for an assessment determines what is recorded, not what a reviewer chooses to look at afterward.
| Level 2 | Level 3, Advanced | |
|---|---|---|
| Webcam | Periodic snapshots | Full continuous video |
| Screen | Periodic snapshots | Full continuous video |
| Audio | Not captured | Full continuous audio |
| Storage location | Codility infrastructure, encrypted at rest | Codility infrastructure, encrypted at rest |
| Default retention | 30 days | 30 days |
| Typical use case | Standard integrity signal across high-volume assessments | High-stakes hiring, regulated industries, executive and security-cleared roles |
Scope note
This reference covers Screen proctoring, where levels 2 and 3 apply. Codility Interview uses a separate proctoring model: session recording with live integrity signals and a full transcript available to reviewers. Interview retention and access controls are documented separately and are not restated here.
How data is processed
Media moves through a session recording sub-processor before it is transferred to Codility’s own environment for storage and review.
- Capture
- Webcam, screen, and audio streams are captured in the candidate’s browser during the assessment session, at the level configured for that assessment.
- Session recording and media processing
- Codility uses Twilio as a sub-processor for session recording and media processing. Twilio does not perform proctoring storage.
- Transfer
- Recordings and snapshots are transferred from the media processing sub-processor to Codility-managed infrastructure for retention.
- Storage
- Proctoring artifacts are stored on Codility-managed infrastructure, encrypted at rest, for the retention window configured on the account.
- Review
- Authorized reviewers in the customer’s account access proctoring artifacts through the Codility platform. Access is not open by default to every platform user.
- Deletion
- At the end of the retention window, proctoring artifacts are deleted. The default window is 30 days.
Retention
One retention period applies across both proctoring levels today.
- Default window
- 30 days for all proctoring artifacts, at every level. This is a single documented period, not a range that varies by level or by data type.
- What happens after 30 days
- Proctoring data is deleted. The default outcome is a deletion event, not a retained-unless-removed state.
- Shortening retention today
- A shorter retention window can be configured through Codility support on request.
- Customer-defined retention
- Self-serve retention configuration, set by the customer from their own admin console without a support request, is in development on the near-term roadmap. It is not available today.
Roadmap, not shipped
Customer-defined retention windows configurable from the admin console are in development. Until that ships, a shorter retention period is available by contacting Codility support. Do not represent self-serve retention control as available today.
Where data lives and who can access it
Storage and access are both scoped to Codility-managed infrastructure and the customer’s own account.
- Storage location
- Codility-managed infrastructure. Not stored by the session recording sub-processor after transfer.
- Encryption
- Encrypted at rest.
- Access scope
- Authorized reviewers within the customer’s own Codility account. Access is controlled, not open to the general platform population.
- Sub-processor involvement
- Twilio is used for session recording and media processing only. Twilio is not a storage sub-processor for proctoring artifacts.
Compliance credentials
Credentials that apply to the Codility platform, including the systems that handle proctoring data.
SOC 2
Audited.
ISO 27001
Certified.
GDPR
Compliant. A Data Protection Impact Assessment is available on request.
CCPA
Compliant.
WCAG 2.1 AA
Accessible.
EU AI Act
Documented methodology and auditable scoring support Codility’s high-risk classification compliance posture. No AI or ML is used in automated hiring decisions.
These credentials describe the Codility platform. They are not a claim that any single feature has been independently certified in isolation.
Why 30 days
The reasoning behind the default, for a reviewer who has to explain the choice internally.
- Defensibility window
- Long enough to cover review, dispute, and sign-off across a typical hiring decision cycle. Short enough that it does not raise the first question in an audit.
- Data minimization
- Codility does not retain proctoring artifacts longer than the review need requires. The default outcome is deletion, not an opt-out a customer has to remember to trigger.
- Predictable obligations
- One documented retention period across both proctoring levels simplifies a customer’s DPIA, DPA disclosures, and right-to-erasure response.
Compared to common alternatives
Some platforms retain proctoring evidence indefinitely. Others push storage responsibility to the customer without native review tools. Codility’s 30-day default sits between the two: reviewable while a decision is active, deleted once the window closes.