Platform Security
How we protect your data, accounts, and certification integrity.
Security Architecture
Review the controls your work needs
Use these topics to scope a security review with our team. Request current deployment evidence for any control that is required by your organization.
Authentication & Access Control
Ask us to review the account, organization, and administrative permissions relevant to your use case. Confirm authentication requirements before connecting sensitive workflows.
Data Protection
Confirm the data you intend to use, where it will be stored, and which connected providers will process it. Request current encryption, isolation, and retention documentation for your deployment.
Audit & Compliance
Request the audit records and control mappings relevant to your procurement requirements. An internal mapping is not an independent audit or certification.
API Security
Review the endpoints and integrations in scope, credential permissions, and abuse controls. Provider services have their own access rules and usage limits.
Session Security
Confirm session behavior and access-revocation requirements for your team. Sensitive actions and connected services should be included in your access review.
Infrastructure
Request the current hosting, backup, recovery, and monitoring details for your deployment. Recovery targets and service commitments belong in the agreed engagement scope.
Compliance Posture
Frameworks we align to
We map our controls to widely recognized security and AI governance frameworks so enterprise teams can evaluate us with confidence.
SOC 2
Controls mapped to Trust Services Criteria for security, availability, and confidentiality. Formal audit evidence is published only after owner-approved reports exist.
GDPR
Data minimization, privacy-rights workflows, and enterprise DPA support are mapped for review.
CCPA
Consumer-rights workflows are mapped for access, deletion, and opt-out handling.
EU AI Act (Article 9)
Risk management, data governance, and transparency obligations mapped for AI-driven assessment features.
ISO 27001
Information security management controls aligned to Annex A. Formal certification on the roadmap.
NIST AI RMF
AI risk functions (Govern, Map, Measure, Manage) applied to our certification and assessment pipelines.
Certification Integrity
Credentials you can trust
An AI certification is only as valuable as the integrity behind it. We enforce anti-fraud measures at every stage of the assessment lifecycle.
Proctoring Session Monitoring
Timed exam sessions with activity telemetry detect anomalous patterns and flag submissions for review.
Watermark Tokens
Every lab session and exam attempt is tagged with a unique, non-removable watermark token for traceability.
Integrity Hash Verification
Submissions are SHA-256 hashed at capture time. Any post-submission modification is cryptographically detectable.
Multi-Reviewer Panel
High-tier certifications require independent review by multiple qualified assessors before credential issuance.
Credential Revocation
Credentials can be revoked instantly if fraud or policy violations are confirmed, with full audit trail.
Public Verification API
Employers and partners can verify any credential in real time through our public verification endpoint.
Data Retention & Privacy
Your data, your rights
We collect only what is necessary, retain it only as long as required, and give you full control over your information.
Retention Schedules
- Account data retained while the account is active, deleted within 30 days of closure.
- Certification records retained for 7 years to support credential verification.
- Audit logs retained for 3 years. Legal hold exemptions override standard schedules when required.
Privacy Rights
- Self-service data export in machine-readable format (JSON) from your account settings.
- Right-to-delete requests processed within 15 business days.
- GDPR Article 30 records of processing activities maintained and available on request for DPA signatories.
Responsible Disclosure
Report a vulnerability
We value the security research community. If you discover a vulnerability, we want to hear about it and will work with you to resolve it quickly.
Contact
security@agencyscript.comResponse time: We acknowledge reports within 2 business days and aim to provide a resolution timeline within 5 business days.
Safe harbor: We will not pursue legal action against researchers who act in good faith, follow responsible disclosure practices, and do not access or modify other users' data.
Acknowledgment: With your permission, we will recognize your contribution on our security hall of fame.
Last reviewed: March 2026
For security inquiries, Data Processing Agreements, or to request our full security documentation package, contact security@agencyscript.com.