Security is designed into what we build, not bolted on afterwards. This page summarises how we approach the security of our website, products and the data entrusted to us.

Our approach

Least-privilege access to systems and data, reviewed regularly.
Encryption of data in transit, and at rest where supported by our providers.
Reputable, security-conscious infrastructure and hosting providers.
Guardrails, evals and audit trails on the AI systems we operate.

Data protection

We handle personal data in line with our Privacy Policy and applicable data protection law, and we keep only what we need for as long as we need it.

Monitoring

We monitor our systems for availability and unusual activity, and we keep our software and dependencies up to date.

Responsible disclosure

If you believe you’ve found a security vulnerability, we want to hear from you. Please email hello@xoai.app with the details and steps to reproduce, and give us a reasonable opportunity to address it before any public disclosure. We will not pursue action against good-faith research that respects user privacy and avoids service disruption.

Contact

Security questions? Email hello@xoai.app.