Security & Data Practices

1. Database Security and Row Level Security (RLS)

Our primary database architecture employs strict Row Level Security (RLS) policies. This means access control is enforced directly at the database engine level, not just in application code. Even if an endpoint were misconfigured, the database itself prevents users from reading or modifying records they do not own or have explicit permission to access.

2. Secure Document Storage

Candidate resumes and company payment receipts are sensitive documents. We store these files in private cloud storage buckets that are not publicly accessible via direct URLs.

• When an authorized user needs to view a document, the system generates a temporary signed URL.
• These URLs automatically expire after a short period, preventing long-term unauthorized access or link-sharing.

3. Proctoring Privacy Architecture

Our automated proctoring system is designed to verify test integrity without compromising candidate privacy.

• Local Processing: All facial detection and audio monitoring occur entirely within the candidate's local browser using client-side machine learning models.
• No Recording: We do not record, transmit, or store video feeds, audio clips, or photographs.
• Structured Flags Only: The only data sent to our servers are structured flags (e.g., boolean values indicating "no face detected" or "multiple faces detected" for a given second).

4. Application Layer Security

Beyond the database, our application layer implements several standard protections:

• Role-Based Access Control (RBAC): Strict segregation between Candidate, Company, University, and Admin roles ensures users cannot access interfaces or actions outside their purview.
• Rate Limiting: Critical endpoints (such as authentication, job application submissions, and test processing) are rate-limited to prevent abuse, brute-force attacks, and spam.
• Authentication: All sessions are managed securely via HTTP-only cookies, protecting against cross-site scripting (XSS) token theft.

5. Compliance and Certifications

RankGrad is currently an early-stage platform. We are transparent that we have not yet undergone independent third-party audits for enterprise security frameworks (such as SOC 2 or ISO 27001). As the platform matures, we intend to pursue these formal certifications.