Sign-in and access
-
One central sign-in
Everyone signs in at one address with a verified e-mail, and is passed securely to their own institution.
-
Two-factor authentication for administrators
Platform, partner and institution administrators must use an authenticator app.
-
Protection against password guessing
Sign-in attempts are rate-limited, accounts lock after repeated failures, and a captcha stops automated attempts.
-
Every action checked on the server
Permissions are enforced on the server for every request, never only by hiding buttons.
Exam integrity
-
The timer runs on the server
The remaining time is kept on our server; late answers are refused.
-
Answer keys never reach the browser
Candidates' devices receive questions, never the answers.
-
One active session per attempt
A second device cannot join an attempt; the try is blocked and logged.
-
Published exams and results never change
Exam versions and result versions are append-only; a change is a new version.
Your institution's data
-
Each institution's data is kept apart
Every record belongs to one institution, and automated tests prove one cannot reach another's.
-
Private files behind short-lived links
Documents and files open only through signed links that expire, and uploads are scanned for malware.
-
Passwords and secrets protected
Passwords are hashed with Argon2id, and two-factor secrets are encrypted at rest.
-
An audit log that cannot be edited
Important actions are recorded with who, when and what, and the application itself cannot change or delete the log.
Infrastructure
-
HTTPS everywhere
All traffic is encrypted, and browsers are told to use HTTPS only (HSTS).
-
A web application firewall
ModSecurity with the OWASP Core Rule Set blocks common attacks.
-
A strict Content Security Policy
Pages may run only our own scripts.
-
Encrypted off-site backups
The database and files are backed up every night to encrypted off-site storage, and restores are tested.
Privacy
-
Consent recorded
Candidates' consent to the privacy notice and exam terms is recorded with the version they accepted.
-
Data export and erasure
Candidates can download their data and ask for erasure; erasure removes personal details while exam records stay intact.
-
Data kept only as long as needed
Retention periods delete data automatically when they run out.
Reporting a vulnerability
If you think you have found a security issue, please write to info@macliysglobal.tech. Do not access or change other people's data while testing.