Security and data protection
How participant and organisation data is protected across the platform — written for the people who have to sign off on it.
In short: everything travels over TLS, every record is scoped to the organisation that owns it, proctoring evidence lives in object storage rather than the database, and we never touch your card details.
Access and account security
Encrypted in transit
All traffic between your browser, the exam apps, and our servers runs over HTTPS / TLS.
Roles that scope access
Username-and-password sign-in with server-side sessions. ADMIN and STANDARD roles determine what each user can do.
Organisation isolation
Every record — quizzes, participants, assessments, evidence — is scoped to its owning organisation. One customer's data is never visible to another.
Bot protection
Sign-in, signup, and password-reset flows are protected by reCAPTCHA Enterprise.
Password reset by code
Resets use a one-time code sent by email, not a click-through link — so there is no reset URL to leak or replay.
Separated surfaces
The exam app can only reach participant-facing endpoints. It has no route to organisation or reviewer APIs at all.
Protecting the test itself
- Correct answers are never sent to the exam device. There is nothing in the client to inspect, so reading the traffic gains an attacker nothing.
- Participants authenticate to an exam with a unique, expiring secret key — not a shared password or a reusable account.
- The exam app talks only to the participant-facing exam endpoints; the reviewer and organisation APIs are unreachable from it.
For what proctoring does and does not do, see Proctoring — including an explicit account of its limits.
How evidence is stored
- Evidence bytes — camera stills, screen images, audio clips — are stored in Google Cloud Storage. Image and audio data never goes into the database.
- Only references and event rows live in the database, keyed to the attempt.
- Capture is bounded by per-kind and per-type caps, so no client can flood your storage.
- Evidence is available only to reviewers in the organisation that owns the attempt.
Retention periods and participant rights are set out in the Privacy Policy. For participant data, the organisation running the assessment is the controller and ZiniApps is the processor.
We never handle your card
Payments are processed by Razorpay. Card details are never handled or stored by ZiniApps — they do not pass through our systems.
Order settlement is confirmed server-to-server through signed webhooks, with a reconciliation job as a backstop, so a payment cannot be lost between the gateway and your credit balance.
Reporting a vulnerability
If you believe you have found a security issue in ZiniApps Assess, please tell us before telling anyone else, and give us reasonable time to fix it. We will confirm receipt and keep you updated on remediation.
Report it by creating a ticket — mark it as a security issue and it will reach our security team.