1. Payments
Payments are processed through our authorised payment service providers, including Stripe. Card data is entered on the provider's own hosted checkout and is handled according to that provider's security and privacy practices. SecByte never receives or stores full card numbers, CVV codes or bank credentials. We retain only a transaction reference, amount, currency and status so we can support you and issue refunds.
2. Transport and storage
All traffic to secbyte.org is served over HTTPS with TLS, and HTTP Strict Transport Security is enabled. Data at rest in our managed database and object storage is encrypted by the platform provider. Private uploads — such as assignment files and payment proofs — are stored in non-public buckets and served through short-lived signed links.
3. Access control
Access to candidate data is enforced at the database layer with row-level security, so a signed-in user can only read their own records. Administrative capability is granted through an explicit role table, checked server-side — never from client-side storage. Administrative actions on credentials are logged.
4. Account security
- Passwords are stored only as salted hashes by our authentication provider; staff cannot read them.
- Sign-in with Google is available so you can rely on your provider's own protections.
- Sessions expire and can be invalidated by signing out.
- Use a unique password and tell us immediately if you believe your account is compromised.
5. Application hardening and monitoring
- User-supplied HTML is sanitised before rendering to prevent script injection.
- Security response headers are applied, including MIME-sniffing and framing protections.
- Dependencies are scanned and patched, and automated security reviews run against our database policies.
- Server-side authorisation checks guard every privileged operation, including coupon redemption and result approval.
6. What we do not claim
No system is "100% secure", and we do not say otherwise. SecByte LLC does not currently hold an ISO 27001, SOC 2 or PCI DSS certification of its own; where our infrastructure providers hold such certifications, that applies to their infrastructure and not to a certification of SecByte. Any certification we obtain in future will be published on the Accreditation page with its issuing body and scope.
7. Responsible disclosure
If you find a vulnerability in our platform, email contact@secbyte.org with the subject "Security disclosure" and enough detail to reproduce it. Please test only against your own account, do not access or modify other people's data, do not run denial-of-service or automated high-volume scanning, and give us reasonable time to remediate before publishing. We acknowledge reports within 2 business days. We do not currently run a paid bug-bounty programme, but we credit reporters who ask to be named.