SciRec Psychometric Assessment Platform

Executive Summary

TKX Media will design, build, test, and launch a production-grade replacement for SciRec's Bubble-based psychometric assessment platform. We will preserve the workflows that already work in your prototype, and deliver a faster, more reliable, and more secure system on a modern code stack — architected to support SOC 2 Type II certification, full WCAG 2.2 AA accessibility, internationalization, and ATS integrations in Phase 2.

This proposal covers the full Phase 1 MVP: three integrated portals (Candidate, Client, Internal), the assessment engine, the Stripe credit system, compliance and accessibility foundations, monitoring, production deployment, and post-launch bug-fix support.

MVP Fixed Price

$45,000

All-in for the Phase 1 MVP base scope. Three milestone payments. No invoicing for work not yet delivered.

• 15 weeks to launch
• 4 weeks of post-launch bug-fix support
• Fixed price + change control

About TKX Media

TKX Media is a full-service digital agency based in South Jordan, Utah. We build and operate production web applications for clients across legal, healthcare, ecommerce, B2B services, and multi-location franchise operators. We hold Clutch-recognized standing, maintain a 95% client satisfaction rate, and ship work 1.8x faster than the industry average.

We work as an extension of our clients' teams rather than as an outside vendor. SciRec will work with the same people week to week, including the partner who signs this proposal.

Why we are a strong fit for this build

• The technical work is in our wheelhouse. Full-stack web applications on Next.js, Laravel, PostgreSQL, Stripe, and AWS are core to what we deliver. Multi-portal role-based access, secure data handling, credit ledgers, transactional email, PDF generation, and GDPR-aware data flows are problems we solve regularly.
• We have done the no-code-to-production migration before. A working Bubble app is a proven business case with a clear technical reason to rebuild. The workflows are validated; the work is translating them into code that scales, hardens, and performs under load.
• We operate the kind of internal tooling you want to build. Beyond client-facing sites, we run our own production systems: dashboards, Stripe-integrated billing flows, scheduled jobs, audit-logged admin tools, and reporting layers. The architecture proposed here is built on the same patterns we use ourselves.

Project Description

Project title: SciRec Psychometric Assessment Platform — Production Rebuild.

A full production-grade rebuild of the SciRec psychometric assessment platform, replacing the existing Bubble prototype with a scalable, secure, and accessible application built in modern code. The platform delivers three integrated portals — Candidate, Client, and Internal — supporting the full assessment lifecycle from credit purchase through job creation, candidate invitation, test administration, and weighted score reporting.

The rebuild retains the proven workflows of the existing app while addressing its limitations in speed, reliability, security, and scalability. It is architected to support future SOC 2 certification, full WCAG 2.2 AA accessibility, internationalization, and ATS integrations.

Project Scope

The platform covers the following capability areas. Each is described at a feature level; the technical delivery sequence is in Section 6.

4.1 Candidate Portal

• Candidate account creation, login, and profile management.
• Email-invitation-driven assessment access with contextual instructions per assessment type.
• Single-visit and multi-visit assessment completion with autosave.
• Real-time status tracking (not started, in progress, completed, expired, etc.).
• Document and image upload for relevant question types.
• Proctoring controls during test-taking: fullscreen enforcement, paste/copy disabling, window/tab change monitoring.
• Per-assessment and per-question time limits, visible to the candidate.
• Error reporting and exit-mid-assessment flow.
• FAQ access and direct support contact.
• Optional results viewing where the client has enabled it.

4.2 Client Portal — Account, Users & Billing

• Company account creation with logo upload and company-level settings.
• Four-tier role-based access control: Super-Admin, Admin, Editor, Reviewer.
• User invitation and management within the company account.
• Stripe-powered credit purchase: pay-as-you-go and bulk packs with discount tiers.
• Credit balance tracking, automatic deduction on job publication, transaction history with export.
• One free credit on signup.

4.3 Client Portal — Assessment Builder

• Browse the public test library plus the company's own private library.
• Build custom assessments combining multiple question types: text, single/multi-select multiple choice, multiple ratings, ranking (drag-and-drop and dropdown), dropdown lists, file upload, picture choice, and matrix rating scales.
• Configure scoring per question: auto-scored, manually scored, or unscored.
• Set custom manual scoring scales, time limits per question and overall, and per-question/assessment attributes.
• Drag-and-drop reordering, inline editing, deletion of questions.
• Save assessments as draft or published.
• Build batteries (groupings of assessments with custom weightings).
• Preview at the question, assessment, and battery level.
• Clone assessments and batteries.

4.4 Client Portal — Jobs & Candidate Management

• Create job vacancies with attached assessments/batteries and custom weights per assessment in the composite score.
• Configurable candidate cap and 60-day validity per job. Draft, published, expired, and closed states.
• Invite candidates by spreadsheet upload, manual entry, shareable link, or selection from existing candidates.
• Duplicate detection across the candidate pool.
• Candidate progress tracking across the pipeline.
• Mark candidates as Rejected, Possible, Selected, etc.
• Add notes to jobs.

4.5 Client Portal — Scoring, Reporting & Exports

• Per-assessment scores and weighted composite Total Score (formula form, e.g., 2A + B + C + 0.5D, weights non-negative).
• Partial scoring when only some assessments are complete.
• Manual scoring interface for questions requiring it.
• Proctoring violation flags surfaced alongside results.
• Candidate ranking by individual and composite scores.
• Branded PDF report generation in two variants: candidate-facing and client-facing.
• Data export in Excel, CSV, and PDF formats.

4.6 Internal Portal (SciRec Staff) / Super Admin

• Client and candidate account management across the platform.
• SciRec staff invitation and access management.
• Manual credit adjustment per company account.
• Platform-wide transaction monitoring.
• Authoring of public assessments visible to all client companies.
• Stripe package configuration (credit tiers and pricing).
• Automated email management (invites, reminders, transactional).
• FAQ creation, editing, and per-user-type visibility control.
• Site-wide assessment data download for analysis.
• Variables / feature-flag controls for app updates that do not interrupt active assessments.

4.7 Compliance & Security Foundations

• GDPR compliance including data subject access and deletion.
• Encryption at rest and TLS 1.2+ in transit.
• Secure authentication with appropriate password policies.
• OWASP Top 10 protection.
• Comprehensive audit logging of significant user and system actions.
• Role-based access enforcement across all portals.
• Configurable data retention and deletion policies.
• Architecture and processes prepared for SOC 2 Type II certification in Phase 2.

4.8 Accessibility Foundations

• Semantic HTML, correct heading hierarchy, landmark regions.
• Full keyboard navigation with visible focus indicators.
• WCAG color contrast ratios (4.5:1 normal, 3:1 large text).
• Text alternatives for all non-decorative imagery.
• Form labels and meaningful error messaging.
• Assessment-taking interface usable with screen readers.
• Foundations sufficient to support a Phase 2 WCAG 2.2 AA formal audit without significant rework.

4.9 Performance, Reliability & App Updates

• High availability and redundancy.
• Horizontal scaling to support concurrent assessment sessions during peak recruitment windows.
• Graceful deployment process that does not interrupt candidates mid-assessment.

4.10 Monitoring & Observability

• Application error tracking (Sentry).
• Session replay and product analytics for debugging and user-behavior insight (PostHog), implemented with candidate data privacy and GDPR considerations.
• Uptime and performance monitoring.
• Centralized logging.

Project Phases

Delivery is structured in three phases. Phase 1 (the MVP) is fully scoped and fixed-price under this proposal. Phase 2 items are quoted with indicative ranges per item in Section 9.5, with each item to be confirmed with a fixed sub-quote once final acceptance criteria are agreed. Phase 3 covers possible future capabilities listed in the SRS that the MVP architecture supports but that are not quoted at this stage.

5.1 Phase 1 — MVP (Current Engagement)

Full delivery of the scope listed in Section 4: all three portals, the assessment engine, the Stripe credit system, compliance and accessibility foundations, monitoring, production deployment, and four weeks of post-launch bug-fix support.

5.2 Phase 2 — Extended Features & Compliance Certification

The fourteen Phase 2 items below correspond directly to SRS Section 4 (items a–n). Indicative price ranges are given per item in Section 9.5. We recommend Phase 2 be delivered as a series of post-MVP sprints, with each item separately scoped and fixed-priced before work begins. Items can be re-ordered, deferred, or removed without affecting the other items.

1. Data migration from the existing Bubble application. User and company data, and where viable, assessments and batteries. Scope depends on Bubble user volume at the time of MVP launch. Passwords cannot be migrated; users will be required to reset their passwords.
2. Organizations. Sub-units within a client account that are invisible to each other. A Client Super Admin can create multiple organizations and manage all of them; organization admins and users see only their own organization's jobs, assessments, batteries, and candidates. Credits are shared across all organizations within a company, with usage monitorable at the organization level.
3. Dimensions. Sub-tests within an assessment that return their own scores and carry their own weightings (for example, the five dimensions of a Big 5 personality test). Individual questions can be assigned to specific dimensions.
4. Questions tab in the main menu. A library of all questions available to a client. Questions can be viewed, edited, cloned (with the exception of questions authored by SciRec), and added to assessments via an Existing Question feature. Questions built in the Assessment Builder can optionally be promoted into the library.
5. Candidate anonymization. Clients can review candidates without seeing real identities. Identities are replaced with pseudonyms (for example, animal colour/name combinations such as Green Owl or Blue Hippo).
6. Random question selection from a larger question bank. Assessments can hold more questions than are administered, with questions drawn randomly at administration time. Individual questions can be marked as mandatory to guarantee inclusion.
7. Tags on Jobs, Assessments, and Batteries. Reinstating tag-based organization that exists in the current Bubble app.
8. WCAG 2.2 Level AA compliance. Formal accessibility audit and remediation. The MVP foundations (semantic HTML, keyboard navigation, contrast, focus indicators, labels, error messages) are built to make this audit pass without significant rework.
9. SOC 2 Type II compliance. The engineering and process work required to achieve and maintain SOC 2 Type II certification. The MVP is built to be SOC 2-compatible from day one (audit logging, infrastructure-as-code, access controls, data retention policies). External auditor fees and continuous-monitoring tooling are paid directly by SciRec to the relevant vendor.
10. ATS integrations. Integration with applicant tracking systems such as Greenhouse, Workday, BambooHR, and Zoho Recruit. Typical capabilities: job creation/posting/import, inviting candidates from inside the ATS, returning assessment results back to the ATS.
11. Public SciRec API. A documented public API for client integrations, including OpenAPI specification, authentication, rate limiting, and developer documentation.
12. White labeling. Per-client visual theming and custom domain support.
13. Candidate identity verification. Webcam snapshots at intervals during an assessment, audio recording, and other monitoring options to verify candidate identity. Any third-party identity verification vendor costs are paid directly by SciRec.
14. Google and Apple sign-in. OAuth-based sign-in for candidates and users, in addition to the existing email and password method.

5.3 Phase 3 — Future Capabilities (Architectural Readiness Only)

To be scoped separately. The MVP architecture supports these without rework, but they are not quoted at this stage:

• Question and answer-option randomization.
• Statistics dashboards for clients and SciRec users.
• Multi-stage assessment process.
• Advanced statistical scoring (tertiles, quartiles, percentiles, Z-scores).
• Internationalization including non-Roman alphabets (Arabic, Chinese).
• Mobile responsiveness for both client and candidate portals.
• Credit-based job duration extension.
• Job Groups.
• Data localization.

Phase 1 Milestones

Phase 1 is delivered across nine milestones. Each milestone produces a reviewable deliverable and an opportunity for feedback before the next begins.

Milestone 1 — Discovery, Architecture & Planning

• Kick-off and structured review of the SRS with the founders.
• Access to and detailed analysis of the existing Bubble application.
• Final tech stack confirmation and written justification.
• High-level architecture document, data model design, and infrastructure plan.
• Sprint cadence agreement, project board setup, and communication protocol.

Milestone 2 — UI/UX Design for All Three Portals

• Refreshed visual identity and design system / component library.
• Complete UI/UX designs for the Candidate, Client, and Internal portals.
• Accessibility-conscious design decisions baked in from the start.
• Design sign-off before development begins.

Milestone 3 — Platform Foundation

• Cloud infrastructure provisioned via infrastructure-as-code.
• CI/CD pipeline established.
• Database schema implementation.
• Authentication system and four-tier role-based access control.
• Audit logging framework.
• Transactional email integration.
• Core API scaffolding.

Milestone 4 — Candidate Portal & Assessment Engine

• Candidate account creation, login, and profile flows.
• Assessment-taking interface supporting all question types.
• Proctoring controls (fullscreen, paste/copy/window monitoring).
• Per-assessment and per-question time limits.
• Autosave for in-progress responses.
• Status tracking and document upload support.
• Error reporting and mid-assessment exit handling.

Milestone 5 — Client Portal: Assessment Builder & Job Management

• Test library access (public and private).
• Full Assessment Builder with all question types, scoring configurations, and drag-and-drop editing.
• Batteries with custom weightings.
• Preview, clone, draft/publish, and tag functionality.
• Job vacancy creation with assessment/battery assignment and weight configuration.

Milestone 6 — Client Portal: Candidate Management, Scoring & Reporting

• Candidate invitation flows (spreadsheet, manual, link, existing).
• Duplicate detection.
• Candidate review and progression interface.
• Composite weighted scoring engine, including partial-score handling.
• Manual scoring interface for relevant questions.
• Two-version PDF report generation (candidate and client).
• Data export across Excel, Sheets, CSV, and PDF formats.

Milestone 7 — Stripe Credits System & Internal Portal

• Stripe credit pack configuration with tiered pricing.
• Credit purchase, balance tracking, and consumption on job publication.
• Transaction history and export.
• Internal portal: client and candidate account management, manual credit adjustments, public assessment authoring, automated email controls, FAQ and tooltip administration, and Variables / app-update controls.

Milestone 8 — Testing, Compliance & Security Hardening

• Unit, integration, and end-to-end test coverage.
• Cross-browser and tablet-down responsive testing.
• Security testing against OWASP Top 10.
• GDPR compliance verification.
• Accessibility audit against MVP foundations checklist.
• SOC 2 readiness review and gap analysis.
• Performance benchmarking and optimization.
• Monitoring and observability fully configured (Sentry, PostHog).

Milestone 9 — Deployment, Handover & Post-Launch Support

• Production deployment with documented rollout procedure.
• Source code repository transfer.
• Technical documentation for ongoing maintenance.
• Founder and team training sessions.
• Four weeks of post-launch bug-fix support with defined response time commitments.

Tech Stack

The platform will be built on a modern, well-supported stack chosen for reliability, security, long-term maintainability, and alignment with SciRec's compliance trajectory (SOC 2, WCAG, GDPR).

Requirements from the Client

To begin Phase 1 on time, the following items will be needed from SciRec. We will coordinate access and walk through any items together during the discovery milestone.

8.1 Access & Credentials

• Login credentials for the existing Bubble application (read-only is sufficient).
• Stripe account access (sandbox and production).
• AWS account access or willingness to have us provision a new one on SciRec's behalf.
• Domain name and DNS access for production deployment.
• Email sending domain authorization (SPF, DKIM, DMARC records).
• Any existing GitHub, monitoring, or analytics account access if available.

8.2 Reference Materials

• Walkthrough sessions with the founders on the current Bubble workflows.
• Sample assessments, batteries, and question content from the existing system.
• Brand guidelines, logo, and any visual identity assets.
• Existing PDF report templates (candidate-facing and client-facing).
• Any documentation of edge cases, business rules, or workflow exceptions not in the SRS.

8.3 Coordination & Decision-Making

• A primary point of contact for project coordination and review cycles.
• Founder availability for design reviews at the end of Milestones 1 and 2, and product reviews at the end of Milestones 4, 5, 6, and 7.
• Agreed turnaround times for design and milestone sign-offs to keep the project on schedule.
• Product decisions on open questions identified during discovery (these will be flagged at the end of Milestone 1).
• Sign-off authority and process clearly defined for each milestone gate.

8.4 For Future Phases (Informational)

• Decision on data migration scope from Bubble (Phase 2) — whether user, company, and/or assessment data needs migrating, which depends on Bubble user volume at MVP launch.
• ATS provider selection for Phase 2 integrations.
• SOC 2 auditor selection (for Phase 2 certification).

Pricing & Timeline

9.1 Phase 1 fixed price

$45,000

Full Phase 1 MVP scope as defined in Sections 4 and 6. Includes four weeks of post-launch bug-fix support.

9.2 Timeline

Phase 1 delivery is targeted at 15 weeks from contract signature, including a four-week post-launch bug-fix support window beginning at production launch.

9.3 Payment schedule

Three milestone payments tied to verifiable completion criteria. TKX does not invoice for work not yet delivered.

Invoices are due net-15 from milestone sign-off.

9.4 Change control

The fixed price assumes the scope described in Sections 4 and 6. Changes are handled as follows:

1. Either party raises a change request in writing describing the change.
2. TKX produces a written change-impact assessment within three business days, covering scope, effort in hours, price impact, timeline impact, and dependencies.
3. SciRec approves, modifies, declines, or defers. Approvals are logged in the project change log.
4. Changes under $1,500 of impact, not affecting the critical path, are absorbed without modifying the milestone schedule.
5. Changes over $1,500 of impact are added to the contract as a written amendment and invoiced separately on the next applicable milestone.
6. Changes that materially affect timeline trigger a revised milestone schedule, agreed in writing.

9.5 Phase 2 indicative pricing

Each Phase 2 item below is presented as an indicative price range, in line with the RFP request for separate Phase 2 quoting and the SRS guidance that these items will be developed in a series of post-MVP sprints. Each item will be confirmed with a fixed sub-quote once acceptance criteria are agreed, before that sprint begins. Ranges assume Phase 2 work follows the MVP launch and reuses the foundations delivered in Phase 1.

Ranges are quoted in US dollars and assume English-language delivery. Each ATS beyond the first is priced separately within the 4j range.

9.6 Phase 2 items to consider folding into the MVP

Per the RFP request for advice on whether any Phase 2 items would be more efficient to include in the MVP, our recommendations:

• 4g (Tags) — small, low risk, and already a familiar pattern from the existing Bubble app. If SciRec wants tags at launch, they can be folded into Milestone 5 of the MVP at the lower end of the indicative range with no material impact to the 15-week timeline.
• 4n (Google and Apple sign-in) — small, low risk, and improves first-time candidate conversion. Can be added to Milestone 3 (Platform Foundation) at the lower end of the indicative range without affecting other milestones.
• 4i (SOC 2 Type II) engineering foundations — the underlying engineering practices (audit logging, infrastructure-as-code, role-based access control, data retention) are already built into the MVP. Folding the formal certification work itself into the MVP is not recommended, since SOC 2 Type II requires several months of evidence collection in production and a separate external audit.
• 4b (Organizations) — we recommend keeping this in Phase 2. It touches every multi-tenant boundary in the platform and is better delivered as a deliberate, isolated sprint than absorbed into the MVP critical path.
• 4h (WCAG 2.2 AA audit) — the MVP foundations are designed to pass this audit. The formal audit and any remediation are best run as a Phase 2 sprint once the production UI is stable.

Post-Launch Support & IP

10.1 Post-launch support (included)

Four (4) weeks of post-launch bug-fix support are included in the Phase 1 fixed price, commencing on the date of production launch.

Covered

• Bug fixes for defects in delivered functionality (any deviation from agreed acceptance criteria).
• Performance issues observed in production that originate in code we shipped.
• Security patches and dependency updates for critical vulnerabilities.
• Configuration adjustments to observability tooling and email templates.

Not covered

• New features or scope expansions (handled via change control or Phase 2).
• Third-party outages outside our shipped code (we diagnose and advise; resolution is upstream).
• Hosting and infrastructure costs (paid directly by SciRec to AWS, Stripe, Sentry, PostHog, email provider, etc.).

Response time commitments

10.2 Continued support after four weeks

• Hourly: $145/hour, open-ended.
• Retainer: $1,800/month for up to 16 hours.
• Phase 2 sprint engagement: scoped and quoted separately.

10.3 Intellectual Property

All source code, designs, schemas, documentation, and other deliverables produced under this engagement become the sole property of SciRec on payment of the relevant milestone.

We reuse only general-purpose open-source libraries and frameworks, all of which are listed in a third-party-license inventory delivered with the source code. We do not reuse any TKX Media proprietary tooling that would create future dependency.