This page is maintained by the institution operating this Aegis instance. It describes controls enabled in the app today — it is not a compliance certification.
Authentication
- Email + password sign-in with per-request bearer tokens.
- Roles (admin, instructor, assessor, student) held in a separate table and enforced by RLS.
Data at rest
- Managed Postgres with RLS on every user-facing table.
- Private storage buckets for identity photos, webcam snapshots, recordings, and submissions.
- Signed URLs for all downloads; no public object access.
Data in transit
HTTPS end-to-end. Server functions run same-origin; no CORS surface for app-internal APIs.
Integrity and audit
- Every administrative action written to an append-only audit log.
- Retention batches identified by SHA-256 checksums.
- Post-submission identity comparison flags suspicious sittings for assessor review.
Reporting a vulnerability
Please contact the institution's IT/security team responsible for this deployment.