Security

01Institute data isolation

Every institute's data is separated at the database layer. Row-level security policies and server-side functions check the caller's identity and institute on each request, and we cover this with automated database tests for cross-institute access.

02Role-based access

• Separate roles for students, mentors, institute owners, institute admins, faculty and subject coordinators.
• Routes are checked in middleware, in server code and in the database, so a hidden button is never the only barrier.
• Privileged operations verify ownership inside the function that performs them.

03Exam integrity

• Answers are submitted and scored by server-side functions, so scores cannot be edited from the browser.
• Attempts are timed and finalised on the server.
• Institutes see attempt histories for their own students.

04Encryption and authentication

• Traffic between you and Examlytics is encrypted in transit with TLS.
• Data is encrypted at rest by our managed database provider.
• Passwords are never stored in plain text. Sessions use signed tokens that are refreshed regularly.
• Sign-in, password reset and similar sensitive actions are rate limited.

05Email security

Account emails are sent from our own domain through a webhook that is verified with signed requests, so only authentic messages from our authentication system trigger an email.

06Monitoring and updates

We review database security and performance advisories, keep dependencies up to date and apply schema changes only through versioned, reviewable migrations.

07Report a vulnerability

If you believe you have found a security issue, email hello@examlytics.in with the details. Please give us a reasonable time to fix it before sharing it publicly, and avoid accessing data that is not yours. We will acknowledge good-faith reports.