Security Questionnaire

CAIQ-Lite (Consensus Assessments Initiative Questionnaire) — Pre-filled for Procta
Last updated: June 1, 2026

1. Data Security

1.1 Do you encrypt data at rest?
Yes. All data at rest is encrypted using AES-256 via Supabase's encryption-at-rest. Database backups are encrypted with the same standard.
1.2 Do you encrypt data in transit?
Yes. All traffic uses TLS 1.3. HTTPS is enforced via HSTS. Internal service-to-service communication uses TLS where available.
1.3 What is your key management practice?
Encryption keys are managed by the cloud provider (Supabase/RDS). Application-level secrets (JWT signing keys, API keys) are stored as environment variables, never in code. One-time login codes used for two-factor authentication are bcrypt-hashed before storage with a 10-minute TTL.
1.4 Do you have a data retention policy?
Yes. Screenshots: 90 days. Phone camera frames: 24 hours. Violation logs: 1 year. Exam answers: duration of account. See Privacy Policy for full details.

2. Access Control

2.1 How is access to production systems managed?
Production access requires SSH key authentication. Only the deployment pipeline (GitHub Actions) and designated admins have access. No passwords are accepted for SSH. Database access is restricted to the application service account.
2.2 Do you use multi-factor authentication?
Yes. Email-based two-factor authentication is available for all teacher accounts. When enabled, every sign-in requires a 6-digit code delivered to the user's verified email address (10-minute TTL, bcrypt-hashed in storage). We strongly recommend enabling it via the Security tab in the dashboard.
2.3 How are API keys managed?
API keys are hashed (SHA-256) before storage. The raw key is shown once at creation. Keys can be revoked individually via the dashboard. Rate limiting is applied per key.

3. Application Security

3.1 Do you perform code reviews?
Yes. All code changes go through pull request review with required approvals before merging to main.
3.2 Do you run automated security testing?
Yes. Each push runs the full test suite (482+ tests), AST-based syntax checks, and dependency scanning (npm audit, pip check).
3.3 How are dependencies managed?
Python dependencies are pinned in requirements.lock (generated via pip-compile). Node dependencies are pinned in package-lock.json. Both are audited on every build.
3.4 Do you have rate limiting?
Yes. All API endpoints have rate limits (typically 5-60 requests/minute depending on sensitivity).

4. Infrastructure Security

4.1 Where is your infrastructure hosted?
Application: DigitalOcean (Mumbai, India — BLR1 region). Database: Supabase (AWS, ap-south-1). Redis: co-located with the application on the same droplet.
4.2 Do you have a disaster recovery plan?
Yes. Daily encrypted backups to Backblaze B2. Container images are stored in GitHub Container Registry. Deployment is fully automated via GitHub Actions — a new droplet can be provisioned in under 30 minutes.
4.3 How do you handle security incidents?
Incidents are logged and escalated via Sentry (error tracking) and PagerDuty-style on-call rotation. Critical alerts (sustained error rate >5%, authentication anomalies) trigger immediate notification.

5. Compliance

5.1 Is the product SOC 2 audited?
Not currently. We follow SOC 2 control framework but have not undergone a formal audit. A SOC 2 report is planned for Q3 2026.
5.2 Do you comply with DPDP (India)?
Yes. We provide: data subject rights (access, correction, deletion, portability), consent recording, data retention schedules, breach notification, and a DPA template.
5.3 Do you comply with GDPR?
Yes. As a data processor, we support our customers' GDPR compliance through DPAs, data deletion, data export, and sub-processor disclosure.
5.4 Do you sign DPAs with customers?
Yes. A standard DPA template is available at /dpa. Custom DPAs can be requested from legal@procta.net.

6. AI & Machine Learning

6.1 Are AI grading models trained on customer data?
No. AI grading uses a zero-shot prompt approach — the model never stores or trains on student answers. Prompts include the question, reference answer, and student answer only for that request, and are discarded after the response.
6.2 Are proctoring flags reviewed by humans?
Yes. All AI-generated flags and grade suggestions are recommendations, not verdicts. Teachers must review and confirm before they become part of the gradebook.
6.3 What AI providers do you use?
Groq (Llama 3.3 70B) for grading. Providers are configurable via environment variables — customers can point to their own OpenAI-compatible endpoint.

This questionnaire is pre-filled for quick reference. For a fully completed version tailored to your institution, contact sales@procta.net.