For organizations
How is test data handled?
For IT and security reviewers, this page sets out how ELT Practical English Test (PCAT) handles test data, item by item, following the questions security checklists usually ask. The privacy policy is the authoritative source.
Current as of 21 October 2026.
Where is test data stored?
Audio, video and answer text from the test, and database records such as accounts, are stored in Microsoft Azure’s Japan region (Japan East). The storage location does not change when data is processed outside Japan.
Is any data processed outside Japan?
Yes. AI scoring uses Azure OpenAI Service (Microsoft; because it is a global deployment, processing may happen outside Japan), transcription of speaking audio uses the OpenAI API (US), and translating feedback and creating study plans use the Claude API (Anthropic, US). The Claude API receives scores, levels and feedback only — not answer text, audio, video, names, affiliations or email addresses. Pronunciation assessment runs on Azure AI Speech in the Japan region.
Is test data used to train AI?
Answers, audio and video are not used to train general-purpose or foundation AI models, and are not provided to third parties to train AI. Each AI provider we use states that it does not use data sent through its API for training by default, and we use them with the default settings. To improve PCAT’s scoring accuracy and item quality, we may use answers, audio and scores internally (never video).
What can an organization see about its test takers?
For people who took the test with the organization’s credits, we share the score, overall and skill-level CEFR-aligned levels, the score report and a record of test conditions (whether the camera was used, focus loss and attempts at blocked actions). Answer text, audio, transcripts and test video are not shared with the organization.
Who can see test video?
Using the camera is optional. If it is turned on, the recorded video is reviewed only by authorized staff and contractors, to the extent needed to check for misconduct or handle appeals. It is not provided to organizations and cannot be viewed from the organization portal.
How is the organization portal secured?
Each staff member is assigned an Owner, Manager or Viewer role that limits what they can see. Owners and Managers must use two-step verification (codes from an authenticator app), and an organization can require it for Viewers too. Viewing and exporting results are recorded in an append-only activity log, and exports require re-authentication. The system is designed so that one organization cannot see another’s data, at both the application and database level.
How long is test data kept?
Audio is kept for 2 years from the test date, video for 1 year, and answers and scoring information for 5 years. After that, data is deleted or de-identified, unless it must be kept by law or for disputes.
What happens to test takers’ data when a contract ends?
Unless the contract says otherwise, we delete the test-taker information received from the organization within 90 days of the end of the organization’s contract.
How is payment information handled?
Organizations pay by invoice. When individuals buy credits, card numbers are entered on Stripe’s page; we neither receive nor store them.
Do you run vulnerability assessments, and can you complete security checklists?
We ran an internal vulnerability assessment in October 2026. If your internal approval or security review needs it, we can provide documents and answer your security checklist.
Need documents for your review?
Send us your security checklist if you have one, and we will answer it item by item.