---
title: "Data, privacy and security"
description: "What eSSESSMENT collects, how it's protected, and how long it's kept."
---

> eSSESSMENT docs. Web page: https://presagetech.com/docs/essessment/privacy
> Index of all pages: https://presagetech.com/docs/essessment/llms.txt

# Data, privacy and security

## What's collected

- Answers to questions, with timestamps.
- Camera readings: heart rate, breathing rate, HRV, confidence scores and waveforms.
- Face detected, talking and blinking indicators.

## Off unless you turn it on

- **Location and audio:** off unless the program owner turns them on and the participant opts in.
- **Video:** kept only from Stream steps with **Save recording to cloud** on, after the participant agrees to recording. Capture steps don't save video.

## How it's protected

- Encrypted in transit (TLS 1.2 or later) and at rest (AWS KMS), hosted in the United States.
- Controls modeled on FedRAMP Moderate (NIST SP 800-53), with HIPAA-aligned safeguards.
- Access granted by role at the organization, program and participant level.
- Multi-factor sign-in (authenticator app or passkey) on every account.
- A seven-year, write-once audit log.

## Retention and deletion

- Data is deleted within 30 days of a written request. Backups expire within 90 days.
- Presage keeps a de-identified copy.
- If there's a breach, affected customers are notified within 60 days.

Participants and program builders accept Presage's **Terms of Service**, **Privacy Policy** and **Your Responsibilities** when they sign up. Your organization is responsible for its own participant consent. See [Consent](https://presagetech.com/docs/essessment/consent).