DigiAssess Data Security Statement

Effective Date: April, 2026
Last Updated: April, 2026

DigiAssess, a product of DigiVal IT Solutions, is committed to maintaining the highest standards of data security across its platform. As a system that manages sensitive academic, personal, and biometric data, DigiAssess implements a comprehensive, multi-layered security framework designed to ensure data confidentiality, integrity, and availability at all times.

This policy outlines the technical, administrative, and operational measures adopted to protect data throughout its lifecycle.

1. Security by Design and Default

Security is embedded into the architecture of DigiAssess from the initial design phase. The platform follows a security-by-design approach, ensuring that all components, workflows, and integrations are built with data protection as a core requirement.

Default system configurations are designed to minimize exposure, restrict unnecessary access, and enforce secure practices across all user roles and environments.

2. Data Encryption and Protection

DigiAssess applies strong encryption standards to protect data both in transit and at rest.

All communication between users and the platform is secured using encrypted protocols, preventing unauthorized interception of data. Sensitive data stored within the platform, including academic records and biometric information, is encrypted within the storage environment.

Encryption keys are managed securely, and access to encrypted data is restricted to authorized system processes and roles only.

3. Identity and Access Management

DigiAssess enforces strict identity and access management controls to ensure that only authorized individuals can access system resources.

The platform uses role-based access control (RBAC), where access permissions are assigned based on user roles such as student, faculty, administrator, or coordinator. This ensures that users can only access data relevant to their responsibilities.

Additional authentication mechanisms, including multi-factor authentication, can be enabled to enhance account security. User sessions are monitored, and unauthorized access attempts are detected and logged.

4. Biometric and Proctoring Data Security

DigiAssess processes biometric data, including facial recognition and video recordings, to support exam integrity. Given the sensitive nature of this data, enhanced security controls are applied.

Biometric data is encrypted and stored securely within controlled environments. Access to this data is strictly limited to authorized systems and institutional roles. It is used exclusively for identity verification and monitoring exam conditions.

Retention and deletion of biometric data are governed by institutional policies and applicable data protection regulations.

5. Infrastructure and Cloud Security

DigiAssess is hosted on a secure, multi-region cloud infrastructure such as AWS, which provides high availability, scalability, and built-in security controls.

The platform leverages cloud-native security practices, including network isolation, controlled access to resources, and continuous infrastructure monitoring. Security configurations are regularly reviewed to ensure compliance with best practices.

Cloud environments are designed to protect against unauthorized access, data breaches, and service disruptions.

6. Network Security

DigiAssess employs multiple layers of network security to protect against external threats.

Secure network configurations, firewalls, and traffic filtering mechanisms are used to control access to the platform. Communication between system components is restricted and monitored to prevent unauthorized interactions.

These controls help protect the platform from common threats such as unauthorized access attempts and malicious traffic.

7. Monitoring, Logging, and Threat Detection

DigiAssess continuously monitors system activity to detect potential security threats and anomalies.

The platform maintains comprehensive audit logs that record user actions, system events, and access attempts. These logs provide visibility into system behavior and support forensic analysis when required.

Automated monitoring systems help identify suspicious patterns, enabling timely detection and response to potential incidents.

8. Data Segregation and Isolation

DigiAssess ensures that data belonging to different institutions is logically segregated within the platform.

Each institution operates within its own controlled environment, preventing unauthorized access across organizational boundaries. This isolation ensures that data remains secure and accessible only to authorized users within the respective institution.

9. Secure Development and Testing Practices

DigiAssess follows secure development practices to minimize vulnerabilities within the platform.

Security considerations are integrated into the development lifecycle, including code reviews, testing, and validation processes. Updates and enhancements are tested before deployment to ensure that they do not introduce security risks.

10. Vulnerability Management

The platform undergoes regular assessments to identify and address potential vulnerabilities.

Security issues, when identified, are prioritized and resolved through structured remediation processes. Continuous evaluation helps ensure that the platform remains resilient against evolving threats.

11. Incident Response and Breach Management

DigiAssess shall take commercially reasonable steps to investigate and respond to security incidents. Notification to affected institutions shall be made in accordance with applicable laws and contractual obligations. 

In the event of a suspected or confirmed data breach:

• The incident is immediately investigated
• Access is restricted where necessary to contain the issue
• Affected institutions are notified promptly
• Corrective and preventive measures are implemented

This structured approach ensures timely response and minimizes potential impact.

12. Data Backup and Business Continuity

To ensure data availability and resilience, DigiAssess maintains secure backup and recovery mechanisms.

Regular backups are performed and stored securely. Recovery procedures are in place to restore data in the event of system failures, ensuring minimal disruption to institutional operations.

13. Compliance and Regulatory Alignment

DigiAssess is designed to align with applicable data protection regulations in its operating regions, including the United Arab Emirates and Saudi Arabia.

The platform supports compliance with:

• UAE Federal Decree-Law No. 45 of 2021 (PDPL)
• Saudi Personal Data Protection Law (PDPL)

Through secure data handling, audit trails, and governance mechanisms, DigiAssess enables institutions to meet regulatory and accreditation requirements.

DigiAssess does not warrant or guarantee that the platform will ensure full compliance for any specific institution, as compliance obligations may vary based on jurisdiction and institutional practices. 

14. Shared Responsibility Model

Data security within DigiAssess operates under a shared responsibility model.

While DigiAssess is responsible for securing the platform infrastructure and application environment, institutions and users are responsible for:

• Managing user access and permissions
• Protecting login credentials
• Ensuring secure usage of devices and networks

Effective security requires collaboration between the platform and its users.

Failure by institutions or users to adhere to their respective responsibilities may result in security vulnerabilities for which DigiAssess shall bear no liability.

15. Continuous Improvement

DigiAssess continuously evaluates and enhances its security practices to address emerging threats and evolving regulatory expectations.

Security updates, system improvements, and monitoring enhancements are implemented regularly to maintain a robust and secure platform.