Security

What we do to protect your exams and your candidates' data. If you need more detail for a security review, email [email protected] and we will answer your questionnaire.

Hosting and network

• The application, database and files run on a dedicated server at OVHcloud in the United States.
• All traffic goes through Cloudflare, which provides DDoS protection and a web application firewall.
• Every connection uses HTTPS (TLS). Browsers are told to use HTTPS only (HSTS), and sign-in cookies are marked Secure and HttpOnly.

Accounts and sign-in

• Passwords are never stored in readable form: account passwords are hashed with PBKDF2-SHA256, a random salt and 600,000 iterations; candidate and supervisor passwords are hashed the same way.
• After repeated failed sign-ins, further attempts for that account are refused for 15 minutes.
• Teachers and supervisors see a candidate's password only at the moment it is created or reset, to print or send it; it cannot be looked up later.
• Organisations can let staff sign in with Google instead of a password.

Access to data

• Each organisation's tests, exams and candidates are separated by account. Staff an organisation invites only get the exams and subjects they are assigned to; supervisors only see the rooms of their exam.
• Proctoring screenshots, candidates' uploaded answers and candidate photos are served only to signed-in people who run that exam, never from a public link, and are not cached by Cloudflare or the browser.
• Access to the production server and database is limited to the TEX Vietnam JSC operations team and protected by SSH keys.

Exam integrity

• Each candidate can receive a shuffled version of the test. The Service detects a second device signing in with the same candidate and when a candidate leaves the exam window, and shows it to supervisors live.
• Optional screen monitoring, face check (off by default) and Safe Exam Browser configuration.
• For rooms where a lost internet connection is not acceptable, the offline exam server runs the exam on your local network.

Data minimisation and retention

• Proctoring alerts and screenshots are deleted automatically 90 days after the exam date.
• Candidate answers are never sent to AI providers, and we do not use customer content to train AI models.
• We do not store payment card details: payments are handled by Paddle, our merchant of record.

Backups and recovery

• The database is backed up daily and backups are kept for 14 days, stored separately from the application server. Restores are tested.

Incidents

If we discover a breach affecting personal data, we notify affected organisations without undue delay and in any case within 48 hours, as set out in our DPA, and the authorities where required.

Reporting a vulnerability

If you believe you have found a security problem, email [email protected] with the details. Please give us reasonable time to fix it before disclosing it, and do not access other customers' data or disrupt exams while testing. We will acknowledge your report within 3 business days.