What we can evidence, and what we cannot.
We do not hold ISO 27001 or SOC 2 Type II certification. Independent certification is in progress, and we will publish the certificates and their scope when they are issued rather than describe them in advance.
What follows is what the platform actually does. Every line of it is a control you can ask us to demonstrate in a pilot.
How examination data is protected
- Multi-tenant data isolation, applied to every query automatically
- Role-based access, ten roles resolving to scoped tiers
- Capability-gated routes that refuse independently of the menu
- An append-only audit log no account can edit or delete
- Session management, with revocation
- Configurable password policy per institution
- API keys with scopes, and rotation
- Rate limiting on public endpoints
- Scheduled backups, checksum-verified before any restore
- Infrastructure monitoring and a scheduler record
- Evidence on private storage the web server does not serve
- Two-person control on release, refunds and question approval
Compliance-ready
MGT Alcor is built to support institutional compliance requirements including data residency controls and GDPR / DPDP obligations. Independent certification is in progress; we will publish the certificates and their scope when they are issued rather than describe them in advance.
Who is accountable for what
Under the Digital Personal Data Protection Act, 2023, your institution is the Data Fiduciary and we are its Data Processor. It decides what runs and what is kept; we process on its documented instructions and for no purpose of our own.
- We do not use institution data to train models or develop other products
- No analytics, advertising or customer-messaging service receives data from this platform
- Proctoring evidence is kept 180 days by default, and an institution cannot exceed 730
- Processing takes place on infrastructure in India
- A signed Data Processing Agreement is available on request
The full terms are published: privacy policy, data processing agreement, terms of use and grievance redressal.
7 things we would rather you heard from us
Backups cover the database
The nightly dump covers every table. It does not currently cover files held on disk — proctoring evidence, branding logos and in-flight import files. Those are access-controlled in place but are not in the backup, so a total loss of storage would lose them.
5 of 17 connectors are wired
17 integration providers can hold credentials and 5 are wired through to a transport — every channel this platform actually sends on. The rest store settings and call nothing, and every screen says so.
No SSO yet
SAML and OAuth sign-in are not built. The sign-in screen shows the option disabled rather than hiding it, so nobody plans around a capability that is not there.
Certificates are printed, not rendered
Nothing generates a PDF on the server. A certificate is a web page built for printing, and a candidate saves it from their browser. Verification is a public URL and does not depend on the file.
Code and SQL answers are never run
Coding and SQL questions are stored and marked by a person. There is no sandbox anywhere in this platform, so no answer is executed against test cases — do not plan a screening programme around automatic scoring of either.
There is no export
Candidates, results, questions and organisation data cannot be exported from any screen. The audit log is the single exception. Data you put in is reachable through the API and the interface, not as a file.
Question stems are plain text
No rich text, no images and no formulae in a question stem. A sanitiser policy has to be settled before an editor is wired to one, and shipping the editor first is how a question bank acquires markup nobody can safely render.
See it run on your examination.
Bring a real paper, a real cohort and the constraint you think will break it. Thirty minutes, no slides.
No commitment, and no sales sequence afterwards unless you ask for one.