Trust
Security practices
What we actually do to protect accounts, lab work and screening data. These are our own statements about how Signal9 is built and operated — not a third-party audit.
Controls in place today
- Authentication
- Accounts are protected by email and password or Google sign-in. Passwords are never stored by Signal9 in readable form — authentication is handled by our managed auth provider. Staff actions that touch an account (password reset links, unlocks, role changes) require an administrator role and are written to an immutable action log.
- Authorisation and data isolation
- Every table that holds customer data enforces row-level security in the database itself, not only in application code. Learners can read and write their own progress; screening results are readable only by admin and instructor roles; the staff action log is read-only for everyone.
- Encryption
- All traffic between your browser and Signal9 uses HTTPS/TLS. Data at rest is stored on managed infrastructure with provider-level disk encryption. We do not operate our own physical servers.
- Rate limiting and abuse guards
- Expensive endpoints — AI tutoring, screening invites and test emails — are metered server-side per user and per session. Guard trips are recorded so limits can be tuned, and repeated failures raise an incident.
- Monitoring and incident detection
- Client errors, performance samples and guard trips feed an automated sweep that runs on a schedule. Spikes open an incident record and, where a notification target is configured, page the operations team. Sweep health is visible to staff so a silent monitor is detectable.
- Screening integrity
- Candidate screening results are re-graded on the server against the authored lab ground truth. A client-submitted score is treated as a claim, never as the result of record.
- Email authentication
- Outbound mail is sent from a domain published with SPF, DKIM and DMARC records so receivers can verify it genuinely came from us. Sending-domain status is checked against live public DNS before invites go out.
- Data retention
- Diagnostic telemetry is purged after 90 days, client error reports and abuse events after 180 days, and resolved incidents after one year. Account and progress data is kept while your account exists and is removed on request.
Certifications
Signal9 does not currently hold a SOC 2, ISO 27001 or comparable third-party certification, and we don't claim one. If your procurement process needs a security questionnaire completed, email us and we'll work through it directly.
Reporting a vulnerability
Send findings to security@signal9.sh. Include the affected URL, reproduction steps and any proof-of-concept output. We aim to acknowledge reports within two business days and to keep you updated until the issue is closed.
Please test only against your own account, avoid automated scanning that degrades the service for others, and don't access or modify another person's data. We won't pursue action against good-faith research that follows those rules.
Related pages
- Privacy policy — what we collect and why.
- Subprocessors and data processing — who else touches the data.
- System status — live component health.