The infrastructure mission-critical assessment runs on.
Universities, awarding bodies and certification providers put their exams, their candidates and their reputation on Paragin Group. Here is the evidence that decision holds up.
The standards your procurement team asks about.
Every item below states where it stands today. We do not claim a standard we have not met.
ISO 27001
Certified since 2015, for all managed technical assets and all software products we offer, and checked by external auditors.
GDPR
Every subprocessor is assessed and bound by a written data protection agreement before we use it. The full list is public, with a change log.
Data residency
All data stored within the European Economic Area (EEA), in data centres that are ISO 27001 certified themselves.
Authentication & encryption
SSO, OAuth2, SAML, SURFconext and Microsoft Entra support, plus two-factor authentication (TOTP) and adaptive password hashing. All communication encrypted with TLS, A rating minimum.
Independent testing
Security audits and penetration tests by external organisations, alongside our own internal security team.
A company built to last
Paragin Group has run assessment technology since 2000. Today that is 120+ people and more than 1,000 organisations across 20+ countries. For more than 25 years our teams have worked on one thing, assessment and the administration around it, and on making it fair, secure and reliable.
Our infrastructure runs in a high-availability set-up, with firewalls and load balancing, monitored 24/7 by our technical team. Our Service Level Agreements commit to 99.5% or higher uptime per month.
Customers and partners can add a three-way escrow agreement with Escrow4all, an ISO 27001 certified escrow provider and approved provider for Microsoft and ICANN, so our software stays available to them even in a worst-case scenario.
Your reputation rides on ours. Here is why that is safe.
Exam and awarding bodies, educational publishers and technology vendors carry our reliability to their own customers. Whether that is a risk worth taking comes down to how long we will be around, what happens if we are not, and what you can show your own customers.
Durability
We have operated for more than 25 years, with assessment and the administration around it as our only business, so the platform your customers depend on will still be supported and invested in.
Continuity
An independent escrow arrangement with Escrow4all keeps the software your business runs on available, even in a worst-case scenario.
Evidence you can pass on
Our ISO 27001 certificate covers every product we offer. It is public, as is the Statement of Applicability, so you can hand your own customers the same evidence.
Responsible vulnerability disclosure
Found a vulnerability? We treat every report confidentially, keep you updated until it is fixed, take no legal action over reports made under our policy, and reward every issue not yet known to us. Reach us at support@paragin.com.
Read the full disclosure policy →The documents your risk and legal teams will ask for.
The certificate and the Statement of Applicability are public, and the subprocessor overview is kept up to date in our Privacy and Security Centre. Agreements are shared per product, on request.
Hand your risk team the evidence, or talk to ours.
Download the certificate and Statement of Applicability above, or talk to us about your requirements.
What procurement and security teams ask us
Is Paragin Group ISO 27001 certified?
Yes, since 2015. The certificate covers all managed technical assets and all software products Paragin Group offers, and external auditors check it periodically. The certificate and the Statement of Applicability are public.
Certificates in our Privacy and Security Centre →Where is our data stored?
All data is stored within the European Economic Area (EEA), in data centres that are ISO 27001 certified themselves.
Is Paragin GDPR compliant?
Yes. Every subprocessor is assessed and bound by a written data processing agreement before we use it. The full list of subprocessors is public, with a change log.
See our subprocessors →What uptime does Paragin commit to?
Our Service Level Agreements commit to 99.5% or higher uptime per month. The infrastructure runs in a high-availability set-up, with firewalls and load balancing, monitored 24/7.
What happens to our assessments if Paragin can no longer deliver?
Customers and partners can add a three-way escrow agreement with Escrow4all, an ISO 27001 certified escrow provider, so the software stays available to them even in a worst-case scenario.
How escrow works →Which sign-in and encryption standards are supported?
SSO, OAuth2, SAML, SURFconext and Microsoft Entra, plus two-factor authentication (TOTP) and adaptive password hashing. All communication is encrypted with TLS, A rating minimum.
How do we report a security vulnerability?
Through our public responsible disclosure policy. We reward every report of a vulnerability that is not yet known to us.
Responsible vulnerability disclosure →