Implemented in the current build
- Salted, memory-hard password hashing (scrypt)
- HTTP-only session cookies with expiry; server-side session revocation on sign-out
- Temporary account lockout after repeated failed sign-ins
- Centralized role- and attribute-based authorization on every student-record read
- Tenant isolation between organizations, verified by automated tests
- Answer keys never sent to the student's browser
- Idempotent response saving and submission
- Immutable published item versions and versioned score records
- Append-only audit log of sign-ins, denied access, record views, exports, and score changes
Required before production use
- Multi-factor authentication for staff and administrators
- Encryption at rest and encrypted, tested backups
- Independent penetration testing and vulnerability scanning
- Documented incident-response and disaster-recovery procedures
Certifications
MAAT Assess does not currently hold third-party security certifications. We will list certifications only after they are completed.