- Effective since
- September 28, 2026
This English version is provided for convenience. The Spanish version is the one that applies.
How we protect the data of the companies and of the people that use XEN. This summary is the public version. The full documentation (Statement of Applicability, security testing programme, certification plan and data flow diagrams) is provided to customers and assessors under a non-disclosure agreement, through security@xeneural.com.
Change log
| Date | Change |
|---|
| November 2025 | First version |
| 28 September 2026 | Corporate sign-in, access log visible to the administrator, recovery objectives, security testing programme, certification timeline, platform administration and authenticated email |
The essentials
- Your data is yours. We use it only to provide the Service to you. We do not train artificial intelligence models on it and we prohibit our providers from doing so by contract.
- Encryption in transit and at rest. TLS 1.2 or higher in transit and AES-256 at rest, in databases, files and backups.
- Each company, isolated. Each customer's data is logically segregated and every request is validated on the server against the user's organisation; identifiers sent by the browser are not used for authorisation.
- Corporate access and fine-grained permissions. Corporate SAML or OIDC sign-in, exclusive per company if the customer so chooses, with mandatory multi-factor authentication; roles by module, action and site; least privilege.
- Incident notice within 24 hours. Documented procedure, with notification to affected customers within a maximum of 24 hours of the moment we have reasonable certainty of the incident and a full report within 10 business days.
- A management system in operation. Information security management system compliant with ISO/IEC 27001:2022, with policies, records, internal audit and management review. The certification process began in October 2026.
Product security
| Control | What we do |
|---|
| Authentication | Identity verified on the server in every request; corporate SAML or OIDC sign-in (Google Workspace and Microsoft Entra ID), exclusive per company if the customer so chooses, with mandatory multi-factor authentication; passwords kept encrypted by our identity provider and never readable by Xeneural; TOTP second factor with recovery codes |
| Authorisation | Roles by module, action and site; the customer's administrators manage their users and permissions; support accesses require the customer's authorisation and are logged |
| Segregation between customers | Organisation identifier validated on the server in every operation; queries are limited by design to the active organisation |
| Data integrity | Schema validation, SHA-256 fingerprints of every document, electronic signature with verifiable chain and timestamp, input sanitisation |
| Application perimeter | Strict security headers (CSP, HSTS, origin isolation), global and per-account rate limits, protection against abusive automation on public forms |
| XENI assistant | Context limited to the active company and to the user's permissions; no write action without human confirmation; generated content identified as such; the administrator can switch XENI off for the entire company; model provider with no training on customer data |
Data security
| Control | What we do |
|---|
| Encryption in transit | TLS 1.2 or higher on every connection: browser, mobile applications and integrations |
| Encryption at rest | AES-256 in databases, file storage and backups; integration secrets encrypted with their own key and scheduled rotation |
| Location | Hosting in data centres of certified providers in the United States; delivery and protection of traffic on a global edge network; transfers reported to the Peruvian authority and covered by standard contractual clauses for European customers |
| Backups and recovery | Database with continuous backup and point-in-time restoration (RPO 5 minutes, RTO 4 hours); documents with daily replication; test restoration every quarter with minutes and annual disaster recovery exercise |
| Retention and deletion | Periods published in the Privacy Policy; export in open formats; certified deletion after termination; legal retention of vouchers and accounting records in an archive with integrity verification |
| Access and activity log | Who did what and when, including sign-ins and support accesses, visible to the customer's administrator; 24-month retention; quarterly review |
Operational security
| Control | What we do |
|---|
| Secure development | Automated tests, vulnerable dependency alerts, dependency analysis with quarantine and signature verification, internal security testing programme classified by impact level, vulnerability management with deadlines by severity, deployment through a workflow after the tests |
| Suppliers | Only suppliers with ISO/IEC 27001 or SOC 2, data processing agreement or equivalent terms and incident notification; public subprocessor list with 30 days' notice of changes |
| Staff and devices | Confidentiality agreements, recorded training, devices with access to company information with disk encryption, automatic locking and up-to-date patches; production access only for authorised staff |
| Platform administration | Internal console separate from the application: every action requires the verified session of an active staff account, each person can access only the sections assigned to them, and deactivating an account takes effect immediately; every staff access to a company's data is recorded in that company's activity log, visible to its administrator |
| Email | Email from xeneural.com is signed with DKIM and authorised with SPF; DMARC is at a quarantine policy with daily reports, moving to reject on 26 October 2026 |
| Continuity | Recovery objectives published in the Service Level Agreement; continuity plan with quarterly test restoration and annual exercise |
| Verification | Continuous programme of internal security testing; external penetration test with the stage 2 certification audit (January 2027) and annually thereafter; annual internal audit and management review; executive summaries shared with customers under confidentiality |
Incident management
- Detection through monitoring, a notice from a customer or a provider, or a security researcher.
- Immediate containment and logging with owner and time.
- Notification to affected customers within 24 hours of the moment we have reasonable certainty of the incident; the information is completed in phases.
- Notification to the National Personal Data Protection Authority of Peru within the legal period where applicable, and assistance to the customer with its own notifications.
- Follow-up report with root cause, impact, measures and deadlines, within a maximum of 10 business days.
Certifications and status
| Framework | Status |
|---|
| ISO/IEC 27001:2022 | Management system documented and in operation. Certification process begun in October 2026: stage 1 audit in December 2026 and stage 2 audit in January 2027 |
| Infrastructure providers | They hold ISO/IEC 27001 or SOC 2; the list, with the purpose and location of each one, is on the subprocessors page |
Roadmap
| Improvement | Date |
|---|
| ISO/IEC 27001 certificate issued by an accredited body | After the stage 2 audit (January 2027) |
| External penetration test by an independent third party | With the stage 2 audit (January 2027) |
| Field-level encryption with a customer-managed key | Planned evolution on the current database |
Vulnerability reporting
If you find a vulnerability, write to us at security@xeneural.com. Our Responsible Disclosure Policy explains the scope, the response times and the commitment not to take legal action against anyone who researches in good faith. Contact details are also available at xeneural.com/.well-known/security.txt.
Effective since September 28, 2026. Earlier versions are kept and provided on request at legal@xeneural.com.
