Tenant isolation
Multi-tenant architecture with hard isolation at the database and API layer. Your content, candidates, and results never cross a tenant boundary.
Security & trust
The boring layer that makes the rest defensible.
When the auditor, the client, or the candidate questions a result, the answer has to hold up. Here's the architecture that makes sure it does.
Platform security
Six pillars under everything Paraakh does.
Role-based access control
Granular permissions per person: who can create exams, view results, manage questions, run shortlisting controlled per role, per tenant. A role change takes effect on that person's next request.
Tamper-evident audit trail
Every score, every violation, every certificate carries an immutable, time-stamped record built for compliance, dispute, and audit.
Append-only ledger
Billing and AI-usage records are written once and never updated. A full transaction history for every credit, debit, and refund.
Expiring, revocable links
Candidates never create an account or a password. A link to sit a test, confirm a time, or answer an offer is single-purpose, time-bounded, and revocable in one click.
Cloud-native storage
Webcam evidence, screen recordings, and certificates are stored in encrypted S3-compatible object storage with signed access URLs.
CheckedIn · the hiring record
Five properties, each of which is a design constraint rather than a policy.
A hiring system holds the most sensitive data an organisation has about people it did not hire. These are specific enough to check in a technical review, which is the point.
Personal data is encrypted at the field level
Names, emails, phone numbers and CVs are encrypted before they reach the database rather than only at rest on the disk. It is set up from the first candidate record, because it cannot be applied retroactively to data already written.
Tenant isolation comes from the token, never the URL
Every read and write is scoped to the organisation in the signed access token, so a request that names somebody else's organisation gets a not-found rather than a permission prompt. Changing an identifier in the address bar is not an attack surface.
The record is append-only at the database privilege level
The application's own database account has no update permission on the history. An attempt to rewrite a past event is refused by the database, not by application code that somebody could bypass. That is what makes an ownership log usable in a fee dispute.
Erasure destroys the key, not the row
A candidate exercising their right to be forgotten becomes permanently unreadable, while the funnel count, the fee record and the ownership history remain intact and defensible. The duplicate-check hash survives, so a re-uploaded CV does not resurrect them.
Logs carry identifiers and never personal data
Which is why the audit trail is safe to hand to an investigator without redacting it first. If you cannot show your logs to a third party, you do not really have an audit trail.
What is not true yet
There is no SOC 2 Type II or ISO 27001 certificate, and no single sign-on, SAML or SCIM provisioning. Both are commonly procurement conditions above roughly two hundred employees. Ask us where they sit rather than assuming a timeline.
Exam integrity
Ten layers of proctoring. Configurable per exam.
Strict for a high-stakes certification, lenient for a practice quiz every layer is logged, severity-classified, and reviewable by a human before any auto-fail.
Webcam + face detection
Live monitoring with face-api.js detection of no-face / multiple faces.
Screen recording (opt-in)
Candidate-consented screen capture stored as exam evidence.
Devtools detection
Browser devtools, console, and view-source detection with auto-submit.
Tab-switch tracking
Tab changes, window switches, and focus loss timestamped per session.
Fullscreen enforcement
Mandatory fullscreen with violation logging on exit.
Voice detection
Audio detection during exam to catch verbal cheating.
Compliance posture
Built for the day someone asks for proof.
Audit-ready, not audit-ready-eventually
Coverage, certifications, expiry, and recert workflows are tracked continuously not assembled the week before the auditor lands.
Defensible decisions
Every shortlist, score, and certificate has the evidence behind it: violation logs, time analysis, category breakdown, the rubric used.
Configurable retention
Per-tenant retention policies on candidate data, proctoring evidence, and assessment records your jurisdiction, your rules.
Certifications & data residency
Working towards SOC 2 Type II and ISO 27001. Regional data residency available on enterprise plans. For a current security questionnaire, customer reference architecture, or data-processing addendum talk to our team.
Defensible by design
Need our security questionnaire?
Tell us what your procurement team needs questionnaire, DPA, reference architecture, pen-test summary and we'll get it to you fast.