Security & Trust
Assessment data handled with the seriousness it deserves.
Candidate data is sensitive — it determines careers. This page describes how AssessIQ protects that data, how we approach India's evolving data protection landscape, and what controls we apply to keep assessments fair and results trustworthy.
A note on certifications: AssessIQ describes security practices and design intent — not third-party certification status. We do not hold SOC 2, ISO 27001, or equivalent certifications at this time. We will update this page if and when that changes. Buyers who require a specific certification as a procurement condition should ask us directly about our roadmap.
Data protection
How candidate data is protected.
Data protection & DPDP Act awareness
Designed with India's data protection law in mind.
India's Digital Personal Data Protection (DPDP) Act 2023 places obligations on how personal data is collected, processed, and stored. AssessIQ is built to support those obligations: candidate data is collected only for the purpose of assessment, processing is scoped to that purpose, and we aim to give data principals — candidates — meaningful control over their data. We continue to monitor DPDP rulemaking as it matures.
Data location
Where your data is processed.
Assessment data, candidate records, and attempt logs are stored on our managed hosting infrastructure. Written answers for subjective questions are evaluated with AI assistance by AssessIQ evaluators, which sends the answer text to Anthropic's Claude service, operated in the United States. If you have data-location requirements, ask us before you sign up.
Encryption in transit
TLS for all traffic.
All traffic between candidates, administrators, and AssessIQ is encrypted in transit using TLS. Data is held on managed infrastructure. Sign-in codes and session tokens are never stored in plaintext.
Multi-tenant isolation
Your data is never visible to another organisation.
AssessIQ is a multi-tenant platform. Each company or institution operates in a fully isolated tenant context enforced at the database layer through row-level security policies. Admins from one organisation cannot see, search, or export data belonging to another. Candidate data is scoped to the organisation that ran the assessment.
Audit logging
Every action is logged and auditable.
AssessIQ maintains append-only audit logs for all administrative actions: assessment creation and publication, candidate invitations, result access, and configuration changes. Logs are timestamped and cannot be modified or deleted by administrators.
Access controls
Role-separated access across the platform.
The platform enforces strict role separation: super-admins, company administrators, and candidates each see only what their role permits. Sign-in uses an email one-time code or Google sign-in, with optional authenticator-app (TOTP) multi-factor authentication.
Assessment integrity
Fair tests. Trustworthy results.
Proctoring
Integrity v1 is live: an optional fullscreen gate, copy/paste blocking and a tab-switch warning. Tab switches are recorded as integrity events that the admin can see. There is no webcam proctoring and no lockdown browser. Integrity also rests on server-side timers, randomisation, and per-candidate invite links.
Anti-cheat measures
Assessments can randomise question order, and MCQ answer options are shuffled per student when randomisation is on. Time limits are enforced server-side, not only in the browser. Timers start when the candidate begins and consents, and each invite link is issued to one candidate. These measures reduce the value of answer-sharing between candidates in the same drive.
Fairness & bias mitigation
AssessIQ uses anchor-based, rubric-driven scoring rather than subjective judgment. Every assessment outcome carries rationale — what the candidate demonstrated, and at which band. This makes the basis for a score inspectable and challenges to it addressable.
Answer-key protection
Correct answers are never exposed to candidates — not in the assessment UI, not in invite links, and not in any API response that a candidate can reach. Access to correct answers is gated to administrator roles only. Students only ever see complete scores.
Infrastructure
How the platform is built.
Traffic through Cloudflare.
All inbound traffic to AssessIQ is routed through Cloudflare before it reaches the origin server. This provides DDoS mitigation, TLS termination, and an additional layer between the open internet and candidate data. Direct-origin access is blocked at the network layer.
Containerised, isolated services.
The platform runs as a set of containerised services. The web application, the API, background workers, and the database run as separate containers with scoped network access.
Dependency management.
AssessIQ's technology stack is maintained with security updates as a routine part of development — not an afterthought. We aim to keep dependencies current and to resolve known critical vulnerabilities promptly.
Questions about our security posture?
If you have specific data-protection or compliance requirements — DPDP obligations, internal audit questions, or procurement checklists — reach out. We'll give you a straight answer, including where our current posture does and does not meet your bar.
See how it applies to your context