Security

What we actually do, and what we don't claim

Assessment data includes candidates' work and, when proctoring is on, their webcam captures. That deserves specifics rather than badges.

Controls in place

Mechanisms, not adjectives

Each of these is implemented in the product today. None of them is a roadmap item described in the present tense.

Password storage

Passwords are hashed with Argon2id. Plaintext is never stored, logged or recoverable — a reset issues a new credential rather than revealing the old one.

Short-lived sessions with rotation

Access tokens last 15 minutes. Refresh tokens rotate on every use and are tracked as a family, so a replayed token revokes the whole family instead of granting access.

Tenant isolation

The organisation on your access token is the tenant boundary. Every query is scoped to it server-side, and cross-organisation reads are not reachable through the tenant API at all.

Role-based access control

Eight roles across 22 permissions, with per-member grants and revokes, plus assessment-level scoping so a reviewer sees only the drives assigned to them.

Browser hardening

A strict Content-Security-Policy, framing denied outright, MIME sniffing disabled, and geolocation, payment, USB and Bluetooth switched off — so injected code has little to reach for and an assessment cannot be framed by another site.

Verified payment webhooks

Provider callbacks are authenticated by HMAC over the raw request bytes before the body is parsed, compared in constant time, and each event is processed exactly once.

Audit trail

Privileged actions are recorded with the acting user, the organisation, the target and the time. Support access to an account is itself audited and time-limited.

Isolated code execution

Candidate code runs in a sandboxed container with no network access and enforced CPU and memory ceilings, separate from the application.

Server-side enforcement

Plan limits, permissions and payment state are enforced on the server. A subscription is never activated on a browser reporting success — only after the payment provider confirms it directly.

Certifications we do not hold

We will not display a compliance badge we have not earned. If any of the following is a hard requirement for your procurement process, it is better for both of us that you know now.

No SOC 2 Type I or Type II report.
No ISO 27001 certification.
No third-party penetration test report available for distribution yet.
No formal GDPR or HIPAA compliance attestation. Data-handling questions are answered directly and in specifics.

What we will do instead: answer a security questionnaire in specifics, describe exactly how a control is implemented, and tell you when the answer is “we don't do that yet”.

Candidate data

The people being assessed did not choose us

A candidate is not our customer, and they have no say in which platform an employer picked. That asymmetry is worth taking seriously.

Told before it is recorded

The pre-flight check explains what will be captured before anything is captured, and the candidate grants camera and screen-share permission themselves. There is no covert monitoring.

Collected for one purpose

Captures exist to support an integrity decision on that attempt. They are not used for anything else, sold, or shared beyond the organisation running the assessment.

Evidence, not a verdict

A risk score never rejects anyone on its own. Flagged attempts go to a human, and the review outcome is recorded with the reviewer's name against it.

Failures recorded as failures

A camera that stops working is logged as a diagnostic, not as misconduct. A technical fault must never look like cheating.

Questions

What security reviews ask

Who at your company can see our assessment data?

Support access to a customer account requires an explicit, time-limited grant with a stated reason, and every action taken under it is recorded against the real staff member — not the account they are viewing. Elevated access cannot be used to grant itself further privileges, and the grant expires on its own rather than relying on someone to revoke it.

Where is our data stored?

In a managed Postgres database with candidate media in object storage, both within our hosting provider's infrastructure. We will tell you the specific region on request. Assessment data is scoped to your organisation and is not pooled with other customers' for any purpose, including analytics or model training.

Do you use our data to train models?

No. Candidate answers, code submissions, webcam captures and results are used to deliver your assessments and nothing else. The scoring and insight features are deterministic — they compute from your own data rather than from a model trained on anyone's.

How long is candidate media retained?

Webcam and screen captures exist to support an integrity decision, so they are retained with the attempt they belong to and removed on the retention schedule configured for your organisation. If you need a specific retention period to satisfy your own policy, tell us and we will confirm whether we can meet it before you sign anything.

Can we require SSO for our team?

Not today — there is no SAML or OIDC integration in the product, and we would rather tell you that than list it and negotiate later. Access is governed by eight roles across 22 permissions with per-member grants and revokes, and sessions are short-lived with rotating refresh tokens. If SSO is a hard requirement, it is a genuine blocker and worth raising immediately.

How do you handle payment details?

We never receive them. Card and UPI details go directly to our payment provider; we store only a provider reference, the amount and the status. A subscription is activated only after the provider confirms the payment to us directly — never because a browser reported success.

What happens if you have a security incident?

We will tell you, in writing, with what we know and what we do not yet know, rather than waiting until the picture is complete. Report a suspected vulnerability to support@parikshafy.com and we will acknowledge it. We do not currently run a paid bug bounty, and we would rather say so than imply one exists.

Send us your security questionnaire

We will answer it in specifics, including the questions where the honest answer is no.

Have questions? Email sales@parikshafy.com