Security, Privacy &
Integrity Without Compromise
TopPlaced AI is engineered with defense-in-depth principles. From ephemeral proctoring streams to containerized execution sandboxes, every layer is designed to safeguard candidate privacy and maintain assessment authenticity.
End-to-End Cryptography
All communications utilize TLS 1.3 encryption with strict certificate validation. Candidate credentials, authentication tokens, and sensitive records are hashed with salted bcrypt and AES-256 at rest.
- Zero plaintext credential persistence
- TLS 1.3 enforced across all API endpoints
- Ephemeral pairing tokens with SHA-256 hashing
AI Proctoring & Privacy
Real-time multi-face, gaze direction, and smartphone detection run directly on client-side neural vision models. Media feeds are processed ephemerally and never sold or shared with third-party advertisers.
- Client-side MediaPipe landmark detection
- Third Eye secondary mobile desk-cam pairing
- Explicit candidate consent before stream start
Isolated Code Sandbox
Candidate coding solutions execute in isolated ephemeral Docker containers with strict resource, time, and network constraints. In production, execution fails closed if container isolation is unavailable.
- Complete network disconnection (--network=none)
- Read-only root filesystem with noexec tmpfs
- Pre-execution AST security filter for prohibited calls
Strict IDOR & RBAC Controls
Every API route strictly verifies ownership. Resume downloads, contact inquiries, achievements, and live interview sessions cannot be accessed across user boundaries.
- Path traversal prevention on file uploads
- Socket.IO session ownership verification
- Admin role verification on privileged queries
Brute-Force & DoS Throttling
High-frequency rate-limiting middleware guards all authentication and interview endpoints. OTP verification is strictly throttled to 5 attempts per 10 minutes to prevent brute-force attacks.
- Automated 429 Too Many Requests enforcement
- Output size caps (64KB max stdout)
- CORS restrictions to verified origin domains
Cloud Database & Health Audits
Backed by resilient MongoDB Atlas clusters with automatic connection failover, real-time health checks, and strict data isolation between local development fallback and cloud persistence.
- Live connection monitoring via /health
- TLS certificate store verification (certifi)
- Zero local fallback mixing in cloud mode
Security Vulnerability Disclosure
We take platform security seriously. If you have discovered a potential security vulnerability, please submit a report to our security team for responsible review.