Skip to main content
Qwish/Security
Security

Built to be broken into. Safely.

A skill platform is only as valuable as its security. We treat your data the way a bank should treat money — with layered defenses, paranoid defaults, and a public bounty program.

Last updated
May 21, 2026
Version
v2.0
01

Architecture

Qwish runs on AWS in the Mumbai region. Every service is deployed in private subnets behind a stateless load balancer. Internet-facing traffic terminates at Cloudflare for DDoS protection and WAF.

  • All inter-service traffic is mutually authenticated (mTLS).
  • Database access is restricted by IAM and audited at the query level.
  • No production secret is checked into source control.
02

Encryption

  • In transit: TLS 1.3 only. HSTS preload-listed.
  • At rest: AES-256 for object storage, AWS KMS for keys with rotation every 90 days.
  • Backups: Encrypted, stored in a secondary AWS region inside India, restored in monthly drills.
03

Access controls

Internal access to production is gated by SSO + hardware security keys (FIDO2). Every administrative action is logged and reviewed weekly. No engineer has standing production access — access is brokered through just-in-time tokens that expire in 8 hours.

For institutional admins, we offer SAML SSO with major identity providers (Google, Microsoft, Okta).

04

Secure development

  • Mandatory code review for every change.
  • Static analysis (CodeQL, Semgrep) on every pull request.
  • Dependency scanning with daily CVE re-checks.
  • Quarterly penetration tests by an independent firm.
  • Annual red-team exercise covering scoring integrity.
05

Incident response

We have a documented incident response playbook with named on-call rotation, 15-minute acknowledgment SLA, and clear severity tiers. Customers affected by a confirmed incident are notified within 24 hours.

Status & historyLive status: status.qwish.in
Post-mortems are published within 5 working days of incident resolution.
06

Assessment proctoring

Proctored assessments use a combination of device fingerprinting, behavioural analysis (typing cadence, focus events), and risk-based escalation. We do not record audio or video unless the candidate opts in for a recorded session.

All proctoring signals are stored encrypted, surfaced only to the Score Integrity team, and purged after 90 days.

07

Bug bounty

We run a private bug bounty with rewards up to ₹5,00,000 for critical vulnerabilities. To participate, email security@qwish.in with a brief about your background.

Out of scope: scoring manipulation through legitimate test-taking, social engineering of our staff, physical attacks.

08

Responsible disclosure

If you believe you've found a vulnerability, please:

  1. Email security@qwish.in with details and reproduction steps.
  2. Give us 90 days to remediate before any public disclosure.
  3. Don't exfiltrate user data beyond the minimum needed to prove the issue.

We commit to acknowledging within 24 hours, providing a status update within 5 working days, and crediting you in our security hall of fame (if you wish).

09

Compliance

See our Trust Center for the full list of certifications, sub-processors, and audit reports.