Security Policy

Our commitment to protecting your data and maintaining platform integrity.

1. Introduction

SwiftCruit.ai takes security seriously. This Security Policy outlines our security practices, compliance measures, and the steps we take to protect your information from unauthorized access, disclosure, alteration, and destruction.

2. Data Encryption

2.1 Encryption in Transit

  • •All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher.
  • •HTTPS is enforced on all pages of the Platform.
  • •API communications use industry-standard REST with OAuth 2.0 authentication.

2.2 Encryption at Rest

  • •All databases are encrypted using AES-256 encryption.
  • •Sensitive data (passwords, API keys, payment information) are hashed using bcrypt or SHA-256.
  • •Backup data is encrypted and stored securely.

3. Authentication and Access Control

3.1 Password Security

  • •Passwords are hashed using bcrypt with a minimum of 12 salt rounds.
  • •Password policies enforce minimum length, complexity requirements, and expiration policies.
  • •Users are encouraged to enable two-factor authentication (2FA).

3.2 Multi-Factor Authentication

  • •Supports TOTP (Time-based One-Time Password) using Google Authenticator or similar apps.
  • •SMS-based 2FA is available as an alternative.
  • •Administrators can enforce mandatory 2FA for all users.

3.3 Access Control

  • •Role-based access control (RBAC) limits user permissions based on roles.
  • •Admin access is restricted to authorized personnel only.
  • •Access logs are maintained for all administrative actions.
  • •Sessions automatically expire after a period of inactivity.

4. Proctoring Security

Our proctoring system includes multiple layers of security to ensure assessment integrity:

  • •AI-Powered Monitoring: Real-time detection of suspicious behaviors, including unusual eye movements, multiple people in frame, or external materials.
  • •Video Analysis: Algorithms analyze video streams to detect cheating attempts, phone usage, or other violations.
  • •Audio Monitoring: Detection of background conversations or external assistance.
  • •System Integrity Checks: Verification that the assessment environment has not been tampered with.
  • •Recording Encryption: All proctoring recordings are encrypted and stored securely with limited access.

5. Code Security

5.1 Code Sandboxing

  • •User code is executed in isolated, containerized environments using Docker.
  • •Each execution is isolated from other users' code and system resources.
  • •Execution time and memory limits prevent resource exhaustion attacks.

5.2 Code Analysis

  • •Plagiarism detection using algorithms like MOSS (Measure of Software Similarity).
  • •Malware scanning for suspicious code patterns.
  • •Static code analysis to identify security vulnerabilities.

6. Infrastructure Security

6.1 Cloud Hosting

  • •Hosted on secure cloud infrastructure with automatic backups and disaster recovery.
  • •Compliance with AWS, Azure, or GCP security standards and certifications.

6.2 Network Security

  • •Firewall rules restrict access to authorized ports and IP addresses.
  • •DDoS protection via cloud-based security services.
  • •Web Application Firewall (WAF) protects against common web attacks (SQL injection, XSS, CSRF).

6.3 Server Hardening

  • •Regular security updates and patches applied automatically.
  • •Unnecessary services and ports disabled.
  • •Strong SSH key authentication and no password-based SSH access.

7. Vulnerability Management

  • •Penetration Testing: Annual security audits and penetration testing by third-party firms.
  • •Vulnerability Scanning: Automated scans using tools like Nessus, OpenVAS, and Burp Suite.
  • •Bug Bounty Program: We encourage responsible disclosure of security vulnerabilities.
  • •Incident Response: Documented procedures for responding to security incidents within 24 hours.

8. Compliance Commitments

SwiftCruit designs its practices to align with recognized industry standards and applicable data protection laws. We are committed to the following:

  • •GDPR (General Data Protection Regulation): We work to align our practices with EU data protection requirements.
  • •CCPA (California Consumer Privacy Act): We work to align our practices with California privacy requirements.

We are progressing toward formal certifications and independent attestations, including ISO 27001 and SOC 2. We do not claim to hold these certifications or attestations unless and until they have been formally awarded, and we will only reference a certification once it is current and can be substantiated. To request current information about our compliance status, contact security@swiftcruit.ai.

9. Employee Security

  • •Background checks for all employees with system access.
  • •Security awareness training and annual compliance certification.
  • •Non-disclosure agreements (NDAs) for all personnel.
  • •Principle of least privilege: employees have access only to data necessary for their role.
  • •Access revocation upon termination.

10. Data Retention and Deletion

  • •Assessment Data: Retained for 5 years for compliance and historical records.
  • •Proctoring Evidence: Unflagged proctoring evidence is retained for up to 90 days by default and then securely deleted. Where a session is flagged for review, disputed, requested by the recruiting customer, or subject to a legal hold, evidence may be retained for up to 12 months, or longer only where required by law.
  • •User Accounts: Data is deleted within 30 days of account closure request, with exceptions for legal holds.
  • •Logs: Access and system logs are retained for 90 days for security monitoring.

11. Third-Party Security

  • •All third-party vendors must meet our security standards and sign Data Processing Agreements (DPAs).
  • •Regular audits of vendor security practices.
  • •Contracts include data protection clauses and liability limitations.

12. Incident Response

In the event of a security breach or incident:

  • •Immediate investigation and containment procedures.
  • •Notification of affected users within 24-72 hours (as required by law).
  • •Cooperation with law enforcement and regulatory authorities.
  • •Post-incident analysis to prevent recurrence.

13. User Responsibilities

While we implement robust security measures, users also have a responsibility to:

  • •Use strong, unique passwords and enable two-factor authentication.
  • •Keep login credentials confidential and not share account access.
  • •Report suspicious activity or security concerns immediately.
  • •Use secure networks and devices when accessing the Platform.

14. Security Reporting & Responsible Disclosure

If you discover a security vulnerability, please report it responsibly to security@swiftcruit.ai with enough detail for us to reproduce the issue.

  • •Do not publicly disclose a vulnerability before we have had a reasonable opportunity to address it.
  • •Do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability, and do not access data belonging to other users.
  • •Do not disrupt platform availability or degrade service for other users while testing.
  • •We will acknowledge receipt within 24 hours and provide updates on remediation.

Safe Harbor

Security research conducted in good faith and in accordance with this policy is authorized. We will not pursue legal action against researchers who make a good-faith effort to comply with these guidelines, even if a report involves an inadvertent, minor policy violation made in the course of testing.

15. Updates and Amendments

This Security Policy may be updated periodically as we enhance our security practices and comply with new regulations. The most current version will always be available on our website.

16. Contact

For questions about our security practices or to report a concern:

  • •Support: hello@swiftcruit.ai

Last updated: January 2026