Security

Every connection to the service, from a browser or from an exam computer, is encrypted. Nobody on the same network, such as a shared Wi-Fi connection, can read what is sent.

Our servers send browsers instructions that block common attacks, such as another website trying to show our pages inside its own.

• Passwords are stored scrambled, in a way that cannot be turned back into the password. Even we cannot read them.
• When a member of staff signs in from a computer or phone we have not seen before, we email a one-time code to confirm it is really them.
• After 5 wrong passwords in a row, the account is locked for 15 minutes, and repeated requests are slowed down, so passwords cannot be guessed by trying again and again.
• Signed-in sessions are kept on our servers and end after a set time. When you change your password, every other place you were signed in is signed out.
• The cookie that keeps you signed in cannot be read by scripts on the page, and is only sent over encrypted connections.
• Every change you make is checked to make sure it came from our own pages and not from another website.

• Each centre's information is kept separate. Staff at one centre cannot see another centre's data.
• Inside a centre, each member of staff has a role that decides what they can see and do. Staff can also be limited to the branches they work at.
• Students see only their own results, and only after the centre releases them.
• When centres connect their own payment accounts, the secret keys are stored encrypted.

• Only computers that a centre has set up as exam seats can start a test.
• Each test attempt is tied to the seat where it started, so it cannot be taken over from another computer or a browser.
• During a test, the exam app locks the computer: other programs, shortcut keys and copy and paste are blocked, and attempts to get around this, such as connecting a second screen, are recorded for the centre to review.
• Answers are saved as the candidate works and kept safe on the computer if the connection drops, then sent when it returns.

• The databases are backed up every night, and the backups are kept for a short time.
• Speaking recordings are deleted automatically after 90 days, unless an examiner changed the band and the evidence is needed in case the result is questioned.
• Error reports are cleaned before they leave the service. Names, emails, passwords, answers and similar details are removed.
• We send AI providers only what they need to mark or run a test. They are listed in our Privacy Policy.

Only the people who run the service can reach its servers, using personal keys. We look at a centre's data only when we need to, for example to fix a problem the centre has reported.

If we find that centre or student information has been exposed, we will act at once to stop it, tell the affected centres without undue delay, and help them inform anyone they need to. Our Data Processing Agreement sets out what we will tell centres and when.

If you think you have found a weakness in Institify, please email [email protected] with "Security" in the subject line. Tell us what you found, how to see it for ourselves and what it could affect.

Please:

• Give us a reasonable time to fix the problem before telling anyone else.
• Do not access, change or delete other people's data. Use a test account of your own where you can.
• Do not disrupt the service, run automated attacks or try to trick our staff.
• Never test during a centre's live exam.

We will reply within 5 working days and keep you updated. We will not take legal action against anyone who reports a problem honestly and follows these rules.

Security questions or reports: [email protected]. Institify, operated by Pxlhut, Bangladesh.