Security

How we protect your data

Provyn is built for trust. Here's how we protect candidate data, assessment integrity, and recruiter privacy.

Data encryption

All data is encrypted in transit (TLS 1.2+) between the browser, Netlify edge, and Airtable API. Airtable encrypts data at rest using AES-256. Stripe handles all payment data under PCI DSS Level 1.

Assessment integrity

Assessments run in a timed, anti-fraud environment. We capture tab-blur events, paste/copy counts, per-question timing, keystroke cadence, environment fingerprints (screen, CPU, timezone), and optional webcam proctoring. Questions are randomized per candidate. Two-tab locks prevent dual-session cheating.

Answer redaction

Correct answers never leave the server. The runner client receives only the question prompts, options, and metadata. No correctIndex, no acceptedAnswers, no rubrics. The redactForRunner() function strips all answer data before the payload hits the browser.

Authentication

Sign-in uses NextAuth with JWT sessions. Email magic-link tokens are stored hashed in Upstash Redis and expire after 24 hours or first use. Each in-progress assessment has a cryptographically random token (24 bytes) held in an HttpOnly cookie and checked on every autosave and submit. Suspending or deleting an account ends its sessions within a minute.

Credential verification

Anyone can check a credential's live status at provyn.app/verify. Candidates can also download a credential signed with Provyn's Ed25519 key; our public keys are published at /.well-known/jwks.json, so the signature can be verified offline with any standard JOSE library, without trusting our website. Any change to the holder, assessment, score or date breaks the signature.

Access control

Recruiter access requires admin approval. Admin routes are gated by the ADMIN_EMAILS allowlist. Candidate profile edits are scoped to the session email. The client cannot forge a candidate ID. Shortlist entries enforce ownership checks on DELETE/PATCH.

Infrastructure

Hosted on Netlify, database on Airtable and email via Resend: each publishes a SOC 2 Type II report for its own service. Payments via Stripe (PCI DSS Level 1). No self-managed servers, no raw database access. Provyn itself is not yet SOC 2 audited.

Data minimization

We collect only what's needed: name, email, role, assessment answers, and fraud telemetry. We don't track browsing history, clipboard contents, or keystroke content; only timing patterns. Webcam snapshots are low-res, capped at 10 per attempt, and visible only to admin reviewers.

Operational controls

Admin two-factor

Admin tools need a time-based authenticator code on top of sign-in, asked again after 30 minutes without admin activity. Destructive actions and data exports need a code entered in the last 15 minutes. On production, admin changes and exports are refused until the second factor is set up.

Audit log

Every admin action is recorded and also appended to a hash chain that is re-verified every day, so an altered or deleted record shows up. Destructive admin actions email the admins. Security events (sign-ins, admin second-factor results, permission denials, data exports, API key changes) are kept for 13 months with emails and IP addresses stored as keyed pseudonyms.

Backups

The database is backed up automatically by a scheduled job; each backup is checked for completeness and kept for 12 weeks, and a monthly restore drill checks that the latest one is complete, recent and in a shape that can be restored.

Access reviews

Admin access is an allowlist set in the hosting environment, not editable from the app. The admin tools include a 92-day access review covering admins, second-factor status, approved recruiters, API keys and outside systems; each sign-off is recorded in the admin log.

Vulnerability scanning

Before any change reaches production, CI runs static analysis (CodeQL), secret scanning, a dependency audit that fails on unaccepted high or critical advisories, an OWASP ZAP baseline scan, and tests that call every API route without a session to prove it refuses.

Incident response

A written incident response plan covers severities, roles and customer notification. Incidents are logged with a timeline, impact, root cause and follow-ups, and public incidents are posted on our status page.

Data retention

Webcam snapshots are deleted 90 days after grading; email, funnel and rate-limit logs after 90 days; backups after 12 weeks; the security log after 13 months. A deleted account is erased after a 7-day recovery window. These jobs run automatically.

Reporting a vulnerability

If you think you've found a security problem in Provyn, email provyn.app@outlook.com with what you found and how to reproduce it. We aim to reply within five business days and will keep you updated until it's fixed.

  • Test only against your own accounts, and never access or change other people's data.
  • Don't run automated scans that degrade the service, and don't send spam or phishing.
  • Give us a reasonable time to fix the issue before telling anyone else about it.

Machine-readable contact details are at /.well-known/security.txt.

SOC 2 status

Provyn has not yet had a SOC 2 audit. SOC 2 readiness work is under way: we maintain a control inventory mapped to the SOC 2 criteria, collect evidence monthly, and will begin a Type II observation period when customers need it. Our infrastructure providers (Netlify, Airtable, Stripe, Resend) hold their own SOC 2 reports.

Questions about our security posture? Email provyn.app@outlook.com