We hold no certifications today, and we are not going to imply otherwise. Here is what is actually true about the architecture — each line verifiable in a demo.
Authentication is email OTP. No passwords are stored anywhere, so there is no password database to breach. One active session per user, enforced platform-wide.
Authorisation is server-side on every request, deny by default. Tenant isolation is enforced in middleware, not by developer convention — the difference matters when someone is under deadline pressure.
Evidence bytes are never exposed by a public URL; they are streamed through the backend under permission checks. Each artifact carries a SHA-256 recorded at capture.
Retention periods are set per account and per data class, not fixed by us.
Our support engineers cannot enter your account unless you grant an explicit window that expires on its own, and every impersonation is audited.
No SOC 2, no ISO 27001, no CERT-In VAPT, and no published SLA. We would rather tell you that than let procurement discover it later. If a certification is a hard requirement for your institution, say so early and we will tell you honestly where we are.
WCAG 2.2 AA is the target for the candidate-facing exam experience and for this site, and contrast on this site is measured rather than assumed. A full third-party audit has not been carried out. If you have an accessibility requirement for a specific cohort, raise it early and we will tell you plainly whether we meet it today.
