Skip to content

Security Overview

Last updated 2026-10-29 · Version 1.0

This page describes how Xavier protects the Service and the data in it today. It is provided for information; our contractual security commitments are in Annex II of the Data Processing Addendum. The product documentation covers the security model in more detail.

1. Infrastructure

  • The Service runs on Google Cloud in the United States (us-east1), on a managed Kubernetes cluster whose private nodes are spread across multiple zones. Outbound traffic leaves through a fixed address, so customers can allow it in their own firewalls.
  • Tenant databases are hosted on MongoDB Atlas in the United States, or in another storage region if a customer’s Order specifies one, unless a customer keeps its data in its own MongoDB database. Account and billing records are kept in a separate database in the United States. Backups are kept in the same region as the database they back up. Infrastructure secrets are kept in Google Secret Manager.
  • Each customer’s data is kept in its own database, and every session, device credential, and API token is bound to a single Tenant.

2. Encryption

  • In transit: all connections to the Service use TLS.
  • At rest: databases, backups, and infrastructure storage are encrypted at rest by our hosting providers.
  • Application-level: disk encryption recovery keys, escrowed passwords and bypass codes, storage credentials, and integration credentials are additionally encrypted with AES-256-GCM. Saved credentials cannot be read back; revealing a recovery key is an authenticated, logged action.

3. Device trust

  • Each device receives its own identity certificate at enrollment, issued by the Service’s certificate authority. Enrollment challenges are single-use.
  • Device requests are verified against those certificates, including revocation checks. Revoking a device’s certificate cuts it off immediately.
  • Device agents can report only for their own device; a credential extracted from one device grants nothing beyond what that device already does.

4. Access for your team

  • Role-based access: administrators have full control; auditors can see everything but change nothing.
  • Console sign-in can go through your organization’s identity provider over OpenID Connect or SAML 2.0, so your provider’s multi-factor and access rules apply. You can require single sign-on for everyone except named break-glass administrators, who keep a password.
  • Passwords are stored only as salted one-way hashes. Sessions expire. Sign-in, password reset, API, and AI requests are rate-limited.
  • MCP tokens for AI assistants are read-only, work only at the MCP endpoint, can be revoked at any time, and never return recovery keys or other secrets.
  • Every command, script run, recovery key reveal, and AI query is recorded in your activity log with who, when, and the result. The activity log is kept for 365 days.

5. Availability and backups

  • Databases are backed up continuously with 7-day point-in-time recovery, plus scheduled snapshots kept for up to 12 months. The schedule is in the Service Level Agreement.
  • The Service is monitored externally, with alerts to Xavier staff.
  • Uploaded files are kept in each customer’s own storage account. Customers can also keep their database on their own MongoDB, self-hosted or in their own Atlas account; in that case the customer is responsible for that database’s backups and uptime, and Xavier’s backups do not cover it.

6. What we do not claim

  • Xavier does not currently hold third-party security certifications or attestations such as SOC 2 or ISO 27001.
  • Xavier does not yet offer its own multi-factor authentication. Multi-factor applies only when console sign-in goes through your identity provider, and Xavier does not verify that your provider required it. Password sign-in, including for break-glass administrators, is protected by the password alone.
  • Xavier does not sign HIPAA business associate agreements and the Service is not intended for payment card data.

7. Reporting a security issue

If you believe you have found a security vulnerability in Xavier, please report it through our contact form with enough detail for us to reproduce it. Please do not access other customers’ data, disrupt the Service, or disclose the issue publicly until we have had a reasonable time to fix it. We will acknowledge your report, keep you informed, and will not pursue legal action against good-faith research that follows these guidelines.