Security

Security questionnaire

Standard answers for purchasing and security teams. Each one describes a control that is in place today. Questions we can't yet answer in public are left out: ask us and we'll answer them directly.

Version 2026-10-05. Download as Markdown. See also how we protect your data and our sub-processors.

Company and governance

GOV-01Do you have written information security policies?: Yes. A policy pack covers information security, access control, acceptable use, change management, data classification and retention, incident response, business continuity, risk assessment and vendor management. Admins read and sign each policy in the admin tools; each signature is recorded against the exact text and must be renewed yearly.
GOV-03Who is responsible for security?: The founder owns security and every control. Provyn is a small company; the controls are designed for a small team and recorded in the admin tools.

Data handling and privacy

DAT-01What customer and candidate data do you collect?: Account and profile details (name, email, role), assessment answers and scores, and assessment integrity signals (timing, focus changes, paste counts; optional webcam snapshots on proctored attempts). Keystroke content and clipboard contents are not collected. Payment card data is handled by Stripe and never reaches Provyn.
DAT-02Where is data stored?: With the sub-processors listed at /subprocessors (database on Airtable, hosting and file storage on Netlify), each listed with its location.
DAT-03How long is data retained?: Webcam snapshots are deleted 90 days after grading. The email log, funnel events and rate-limit events are kept 90 days. Backups are kept 12 weeks. The security event log is kept 13 months. Deleted accounts are erased after a 7-day recovery window by a daily job. Retention jobs run automatically and report their health.
DAT-04Can individuals access and delete their data?: Yes. Signed-in users can download their data and delete their account themselves. Deletion anonymises attempts and removes snapshots, proctoring events, shortlists, contests and related records.
DAT-05Do you keep personal data out of logs?: Server logs mask email addresses and strip tokens and secrets; error reports are scrubbed before they leave the server. A CI test fails when new logging code prints an email or token unmasked.

Encryption

ENC-01Is data encrypted in transit?: Yes. The site is HTTPS only, with HSTS (two years, including subdomains, preload). Calls to the database and other services use TLS.
ENC-03How are encryption keys managed?: Keys are held as environment variables in the hosting provider, never in the code. Keys are versioned: each ciphertext names its key, a new key can be added without breaking old data, and a re-encrypt job moves stored data onto the current key. Secret rotation dates are logged.
ENC-04Are credentials you issue tamper-evident?: Yes. Credentials are signed with Ed25519; public keys are published at /.well-known/jwks.json so anyone can verify a credential offline.

Identity and access

IAM-01How do users sign in?: With an emailed one-time sign-in link (stored hashed, valid 24 hours or until used) or a supported OAuth provider. Passwords are not used, so none are stored.
IAM-02Do you support SSO (SAML/OIDC) or SCIM for customer accounts?: Not today. Customer accounts sign in with email links or an OAuth provider.
IAM-03Is multi-factor authentication required for administrators?: Yes. Admin tools require a time-based authenticator code on top of sign-in, re-asked after 30 minutes without admin activity; destructive actions and exports need a code entered in the last 15 minutes. On production, while the second factor is not configured, admin changes and exports are refused. One-time recovery codes are stored only as hashes.
IAM-05How is access controlled inside the application?: Admin access is limited to an allowlist set in the hosting environment, not editable from the app. Recruiters are approved by an admin before they can search candidates. Every API route checks the caller itself, and automated tests call every route without a session and as a non-admin and fail the build if any answers.
IAM-06How long do sessions last, and can they be revoked?: Sessions expire by role: admin 7 days (12 hours idle), recruiter 14 days (3 days idle), candidate 30 days (14 days idle). Users can sign out everywhere; suspending or deleting an account ends its sessions within about a minute.
IAM-08How are API keys protected?: Recruiter API keys are shown once, stored only as SHA-256 hashes, expire (30, 90 or 365 days) and can be revoked.

Application security and change management

APP-01How do code changes reach production?: Changes go to a staging branch first. CI runs secret scanning, lint, type checks, unit tests, a production build, an end-to-end browser sweep with accessibility checks, static analysis and a dynamic scan; only a commit that passes is promoted to production, by CI, as the exact commit tested. An emergency fix can be pushed to production directly; it still runs the local checks and CI reports on it afterwards.
APP-03Do you use a Content Security Policy and other security headers?: Yes. Pages send a per-request nonce Content Security Policy, plus HSTS, nosniff, frame and referrer policies. Policy violations are reported and logged.
APP-04How do you protect against abuse such as brute force and spam?: Per-endpoint rate limits on sign-in, signup, submissions, exports, API key creation and webhooks; bot checks on public forms; sensitive routes refuse requests when the rate-limit store is unavailable.
APP-05Are assessment answers protected from candidates?: Yes. Correct answers never leave the server; the assessment page receives prompts and options only, and option order is permuted per candidate on the server.

Vulnerability management

VUL-01Do you scan for vulnerabilities?: Yes, in CI before any change is promoted to production: static analysis (CodeQL, security-extended queries), secret scanning (gitleaks), a dependency audit that fails on any high or critical advisory not explicitly accepted with a reason and review date, and an OWASP ZAP baseline scan of the built site.
VUL-02Have you had an independent penetration test?: Not yet. A scope and rules of engagement for one are prepared.
VUL-03How can researchers report a vulnerability?: By email to the address on /security, also published in /.well-known/security.txt. We aim to reply within five business days.

Logging and monitoring

LOG-01Do you keep an audit log of administrative actions?: Yes. Every admin action is recorded, and also appended to a tamper-evident hash chain that is re-verified daily against the log; destructive actions email the admins.
LOG-02Do you log security events?: Yes. Sign-ins and failures, admin second-factor results, admin actions, rate-limit hits, permission denials, data exports, API key changes and CSP reports are kept for 13 months, with emails and IP addresses stored as keyed pseudonyms. Each request carries a request id that ties logs and error reports together.
LOG-03Are you alerted to suspicious activity?: Yes. Alerts are emailed for repeated failed admin second-factor attempts, bursts of refused admin requests, unusual data export volume, admin sign-ins from a new country and signup bursts; unacknowledged alerts escalate after two hours.
LOG-04Do you monitor errors and service health?: Server errors are reported to an error tracker. Scheduled jobs record heartbeats, and a public status page shows component health and incidents.

Backups and continuity

BCP-01Do you back up customer data?: Yes. The database is snapshotted automatically by a scheduled job; snapshots are checked for completeness and kept 12 weeks.

Incident response

INC-01Do you have an incident response plan?: Yes. A written plan sets out phases, severities and roles; incidents are logged with a timeline, impact, root cause and follow-up actions, and public incidents are posted on the status page.

Sub-processors

SUB-01Which sub-processors do you use?: The current list, with what each does, what data it sees and where, is published at /subprocessors.

Assurance

ASR-01Do you have a SOC 2 report or ISO 27001 certificate?: No. Provyn has not had a SOC 2 audit and holds no ISO 27001 certificate. SOC 2 readiness work is under way: the controls are mapped to the SOC 2 criteria and evidence is collected monthly.
ASR-03Can you fill in our own security questionnaire?: Yes. Email the address on /security.

Need your own questionnaire filled in, or an answer that isn't here? Email provyn.app@outlook.com.