Trust and security

How we protect data

• Each organisation's data is kept separate by rules in the database itself (row-level security), not only by the screens. Automated tests try to read and change one organisation's candidates, reports, credits, files, exports, webhooks and API results from another organisation, and must be refused.
• Least privilege. Every action is checked against the person's role in that organisation. Nobody can give someone powers they do not hold themselves.
• Two-step sign-in. Anyone can protect their account with an authenticator app and single-use recovery codes. GyaniX platform administrators and organisation administrators must use it for sensitive actions such as changing roles, exporting data, creating API keys or webhooks and changing settings.
• Passwords and keys. Passwords are stored only as salted hashes. API keys and sign-in links are stored only as hashes. Authenticator secrets and webhook signing secrets are stored encrypted, with the key kept outside the database.
• Audit trail. Material actions are recorded in a log that cannot be edited or deleted. When a GyaniX administrator opens an organisation's records to help or to keep the service running, that is recorded in the organisation's own log, which its administrators can see.
• Abuse limits. Sign-in, sign-up, password reset, public certificate look-ups, invitations, share links and reports are rate limited.
• Webhooks only ever call public internet addresses over HTTPS (never private or internal networks), are signed, and carry a key so receivers can ignore duplicates.
• Encryption in transit. All traffic to GyaniX uses HTTPS.

How we handle data

• GyaniX runs on servers rented from our hosting provider. Our service providers (hosting, e-mail, payments) process data only on our behalf.
• The database is backed up every day, and we regularly check that a backup can actually be restored. Administrators are warned if the last backup is more than 36 hours old.
• Proctoring evidence and CVs are deleted on the retention schedule each organisation sets. People can download their own data and ask for their account to be deleted from Account & settings.
• An organisation can download all of its data, and its owner can ask for the workspace to be closed. Closing waits 30 days, so it can be cancelled; then the workspace and its uploaded CVs are removed, while each person keeps their own results, and financial records are kept as the law requires.
• See the Privacy Notice for what we collect and why.

If something goes wrong (incident response)

1. Contain: stop the problem first, for example by revoking keys, signing people out or taking a feature offline.
2. Assess: work out what happened, which data and which organisations or people are affected, using the audit trail and server records.
3. Notify: tell affected organisations and people without undue delay, in plain language: what happened, what data was involved, what we are doing and what they can do. We notify regulators where the law requires it.
4. Fix and learn: correct the cause, add a test so it cannot quietly return, and record what we changed.

To report a suspected incident affecting your organisation, e-mail info@xeliumlabs.com with "Security incident" in the subject.

Reporting a vulnerability

If you believe you have found a security weakness in GyaniX, please tell us at info@xeliumlabs.com.

• Include the address or feature, what you did, what you saw, and how we can reproduce it.
• Please do not access, change or delete other people's data, do not degrade the service, and give us reasonable time to fix the issue before telling anyone else.
• We will acknowledge your report, keep you informed and tell you when it is fixed. We will not take legal action against good-faith research that follows these rules.
• We do not run a paid bug bounty programme at present.

Two-step sign-in: account recovery

• Lost or replaced your phone? Sign in with your password and enter one of your recovery codes instead of the 6-digit code, then set up the new phone under Account → Two-step sign-in.
• Lost your phone and your recovery codes? E-mail info@xeliumlabs.com from the address you sign in with. We confirm who you are before anything is changed; the reset itself can only be done by the GyaniX server operator and is recorded.
• GyaniX will never ask you for a code or a recovery code by e-mail, phone or chat.

Contact

Xelium Labs Private Limited · info@xeliumlabs.com