/ trust & security
Security is an architecture.
Not a checklist. Edulexa scopes tenant data at the query layer by default, with dedicated databases available for customers that need physical separation.
/ compliance posture
No certifications claimed
We do not currently hold SOC 2 or ISO 27001 certification. We answer security questionnaires directly.
GDPR + DPDP + FERPA
Built with these obligations in mind. DPA with EU SCCs available with every MSA.
EU AI Act safeguards
Emotion analysis is disabled in the EU/EEA, consent-gated elsewhere, and never used in hiring scores.
Human decisions
Integrity and assessment signals inform a human reviewer. The platform never auto-rejects a candidate.
Encrypted in transit
All traffic served over HTTPS/TLS.
Bias-audit data
Adverse-impact (four-fifths rule) exports for your independent auditor, e.g. for NYC Local Law 144.
/ architecture
Isolated tenancy
Tenant-scoped query filters on every tenant table, with optional dedicated databases for Enterprise tenants.
Sandboxed code execution
Candidate code runs on our self-hosted Piston sandbox in ephemeral, resource-limited containers.
Rate limiting
API rate limiting and per-tenant API keys for headless integrations.
Hash-chained audit log
Governance and integrity events are written to a SHA-256 hash-chained log; a verification check detects altered or broken entries.
Signed webhooks & URLs
Outbound webhooks and protected asset URLs are HMAC-SHA256 signed and time-limited.
Incident response
Security issues reported to security@edulexa.com are triaged by the engineering team.
Need a security questionnaire, DPA, or DPIA input?
Email security@edulexa.com — we respond within one business day.