Quiliver
Sign inStart free

Security isn't a feature. It's the foundation.

Quiliver was engineered so the browser is never trusted: answers are scored on the server, answer keys never reach candidate devices, and every tenant's data is isolated at the database level.

  • Row-Level Security

    PostgreSQL RLS isolates every organization's data

  • Server-side scoring

    Answer keys and grading never leave the database

  • Tamper-proof timers

    Device clocks and refreshes can't extend exams

  • Hashed secrets

    Invitation tokens and API keys stored only as hashes

  • Signed webhooks

    HMAC signatures on every outbound event

  • Full audit trail

    Every administrative action is logged immutably

Three principles behind every request

1

The database is the security boundary

Starting attempts, autosave, scoring, adaptive selection and publishing all run inside PostgreSQL functions that re-check authorization on every call. The browser can never reach a path that skips those checks.

2

The client is never trusted

Candidates receive sanitized question payloads with no answer keys. The countdown timer on screen is only a mirror of the server clock, and every submission is recomputed and scored server-side.

3

Every tenant is isolated

Row-Level Security scopes every table to its organization. Organization A can never read Organization B's exams, questions, candidates or results, and this is verified by automated tests.

Run high-stakes exams with confidence

Security that holds up under real examination pressure, built in from the first line of code. Start free today.

Create your free accountView pricing