Security

• Sign-in issues a signed, expiring token; the platform keeps a record of every active session so a user or an administrator can see and revoke them individually.
• Revocation is immediate — each account carries a token version, and bumping it invalidates every token issued before it, so a compromised session cannot be used until its natural expiry.
• Multi-factor authentication is available for platform administrator accounts, the tier with the widest reach.
• Access is role-based. Placement staff, students and platform administrators see different data and different actions, and student records are scoped to the institution that owns them.

• All traffic is served over HTTPS. Certificates are issued and renewed automatically.
• Uploaded files — resumes, documents and proctoring images — go to a private object-storage bucket with no public read access. Files are served through short-lived signed URLs generated per request, so a leaked link expires rather than exposing the object indefinitely.
• Database access is restricted to the application network and is not reachable from the public internet.

• Correct answers are never sent to the browser. A generated test is stored server-side and scored server-side.
• Student code is executed in a sandboxed runner that we host ourselves — submissions are not sent to a shared third-party execution service.
• Proctoring signals are computed on the student's own device; what leaves the device is the resulting event, not a continuous recording.

Every institution's students, drives, employers and reports are scoped to that institution. Staff accounts cannot read another institution's records, and platform-level administration is a separate account tier with its own sign-in.

Changes to institutional records carry an activity trail showing who changed what and when, so a disputed eligibility decision, a cancelled drive or an edited offer can be reconstructed.

We would rather be straight about this than let a certification badge imply something untrue.

• OneKampas is not currently SOC 2 or ISO 27001 certified.
• We have not published a third-party penetration test report.

If your IT or procurement team needs our backup and restore procedure, incident-response commitments or uptime targets in writing, ask during evaluation and we will provide them alongside the agreement.

If you believe you have found a security issue, please write to contact@onekampas.com with “Security” in the subject line rather than disclosing it publicly, and we will respond.

What data is processed and who else touches it is set out in our privacy policy, including the full sub-processor list.