Security isn't a section of Oriole. It's the architecture.
High-stakes assessment lives or dies on whether a result can be defended. Every layer of Oriole is designed to be encrypted, access-controlled and recorded.
ORL_SECURITY
We take security seriously.
Architected for integrity
Encryption, identity, access and evidence are designed together — never bolted on after the fact.
Encrypted end to end
TLS 1.3 in transit, AES-256 at rest and per-tenant key isolation — one tenant can never reach another.
Audited & compliant
SOC 2 Type II and ISO 27001 aligned, with GDPR and FERPA-ready handling and DPAs on request.
Four layers, one continuous audit trail
From the network edge to the data store, controls are layered so that no single failure compromises an examination — and everything that happens is logged.
Every layer logs to an append-only, exportable audit trail.
Controls across every domain
A complete control set, owned and operated — not bolted on.
Data security
AES-256 at rest, TLS 1.3 in transit, per-tenant key isolation and field-level encryption for sensitive candidate data.
Infrastructure
Hardened, multi-region cloud with isolated environments, infrastructure-as-code and continuous configuration scanning.
Monitoring
Continuous security monitoring, anomaly detection and 24/7 alerting routed to an on-call response team.
Encryption
Keys managed in an HSM-backed service with rotation, and cryptographic separation between tenants.
Compliance
SOC 2 Type II and ISO 27001 aligned, with GDPR and FERPA data-handling and DPA support.
Access controls
Least-privilege RBAC, enforced MFA for staff, SSO/SAML, SCIM provisioning and just-in-time elevation.
Audit trails
Append-only, tamper-evident logs of every privileged action, exportable for inquiry and appeal.
Disaster recovery
Automated multi-region failover with a recovery objective under 15 minutes and seconds-level data loss target.
Business continuity
Tested continuity plans, redundant delivery paths and offline exam resilience for low-connectivity sites.
Threat protection
WAF, DDoS mitigation, dependency scanning, penetration testing and a coordinated vulnerability disclosure programme.
Every action, recorded and exportable
When a result is challenged, you don't reconstruct what happened — you produce it. Oriole writes a tamper-evident record of every privileged action.
Request our security documentation
We'll share our security overview, architecture detail, sub-processor list and a Data Processing Agreement for your review.