Trust Center - Duolingo
Duolingo English Test
The Duolingo English Test (DET) is committed to democratizing English language assessment, aiming for wide acceptance by institutions and governments while ensuring test security and data confidentiality. DET values include safeguarding test taker information and upholding test integrity, as reflected in their security policies with confidentiality provisions. DET’s security controls are multi-layered, with ISO 27001–aligned cloud infrastructure, hardened service templates with strong logging and secure defaults, centralized vulnerability and configuration management, and tightly governed access to test taker data across Duolingo‑managed devices, services, and third‑party providers. DET’s 2026 security roadmap builds on their existing information security management system and their company‑wide security strategy by making security a core product feature by embedding guardrails into our standard engineering defaults, expanding threat modeling and automated vulnerability management for DET’s most sensitive services, and investing in deeper cloud monitoring, threat hunting, and auditable administrator actions across our AWS‑hosted test infrastructure. Continuous improvement is a priority, with regular cross-functional collaboration and open feedback channels.
Compliance
ISO 27001:2022
SOC 2 Type I
GDPR
Resources
- SOC 2 Type I
- Penetration Test
- Incident Response Plan
- Code of Conduct
- Business Continuity and Disaster Recovery Plan
- Information Security Roles and Responsibilities
- Penetration test
- Access Control Policy
- Asset Management Policy
- Business Continuity and Disaster Recovery Plan