Security

Version 2026-09-24

Alumys Tools is a cloud platform run by Alumys LLC in the United States. Its first product, Alumys Assessment, is an examiner console, an examinee exam-taking app and an API. This page summarizes how the platform is built and run; the full security packet, with architecture detail and the September 2026 review ledger, is available on request under NDA.

Hosting and data location

Everything runs on Amazon Web Services in US East (Ohio): application containers, the PostgreSQL database, object storage, email delivery and the code sandbox. Sign-in runs on Auth0, billing on Stripe and error reporting on Sentry, all in the United States. No customer or examinee data leaves the United States. The vendors are listed on the subprocessors page.

Encryption

TLS 1.2 and 1.3 in transit, with HTTP strict transport security on every host. AES-256 at rest for the database, backups, object storage and secrets. Secrets live only in encrypted parameter storage and are loaded when a service starts; a deployment refuses to boot with a missing or placeholder secret.

Identity, sessions and access

• Accounts are held in Auth0; passwords never touch Alumys servers. Sign-up requires a verified email address before an organization can be created or joined.
• Sessions are HTTP-only, secure cookies with rotating refresh tokens. A stolen refresh token is good for one use, and sessions are revoked on logout and on password change.
• Two-factor authentication is required for Alumys staff and available to every customer administrator, who can require it for their organization.
• Every request is scoped to the caller's organization at the API. API keys carry named scopes, webhooks are signed, and changes to settings and members are audit-logged.

Examinee data and the code sandbox

Answer keys and hidden tests are never sent to an examinee's browser. Examinee code runs in an isolated sandbox with no network access and fixed time and memory limits, and is not stored there. Integrity signals are browser events only: focus and tab changes, copy and paste, fullscreen changes and timing. No camera, microphone, screen capture or biometric data is collected. Examinee data is anonymized and erased after the retention period the organization sets; deleting an organization erases every record and identity.

Development and operations

• Dependencies are pinned, updated through automated pull requests and held for a cool-off period after publication. Every change passes build, tests, lint and an architecture check before it merges, and deploys run from CI with short-lived credentials.
• Seven independent security reviews of the code and live configuration were completed in September 2026 before launch. Every finding rated Medium or above was fixed the same day; the remaining low-severity items are tracked as a hardening backlog.
• Health, readiness and an end-to-end exam-path probe are checked continuously and shown on the status page. Database backups run daily with point-in-time recovery and are kept for 30 days in production, encrypted.

Incidents

A confirmed security incident affecting customer data is reported to the affected organizations without undue delay and within 72 hours, with what happened, what data was involved and what Alumys is doing about it. Individuals and regulators are notified where state breach-notification laws require.

Compliance position

Available now: this page, the security packet, a Data Processing Addendum, the subprocessor list with change notice, and an accessibility statement with VPAT for the examinee app. An independent penetration test by a third-party firm completes within 90 days of the first contract that requires one, with a customer-facing attestation letter; SOC 2 Type I follows the first enterprise contract that requires it.

Reporting a vulnerability

Email support@alumys.com with the subject line "Security", or write to Alumys LLC, 626 N Alafaya Trail, Suite 206, Orlando, FL 32828, United States. We acknowledge reports within 2 business days, keep you informed while we fix the issue, and do not pursue researchers who act in good faith, avoid harming examinees and customers, and give us reasonable time to respond. Machine-readable contact details are at /.well-known/security.txt.