What we actually do to secure your data
Written for whoever on your side runs the security review — plain terms, and honest about which parts are formalized today and which are still in progress at our size.
Application security
The practices below are not aspirational — they are what the current codebase actually does, and they can be verified by anyone we grant code access to as part of a due-diligence process.
Encrypted in transit
Every connection to our systems runs over TLS 1.2+. Nothing is submitted or retrieved over plain HTTP.
Parameterised queries throughout
All database access uses prepared statements. There is no code path that concatenates user input into a query.
Passwords are never stored in the clear
Account passwords are hashed with bcrypt. Login attempts are rate-limited per account with an escalating lockout, and every session is invalidated the moment an account is removed.
CSRF protection on every state change
Every action that changes data — not just forms — is protected by a per-session token, checked server-side before anything is written.
Isolated per client
Connected SolmiriX data lives in its own workspace — never pooled or blended with any other client's data, and never used to train a shared or general-purpose model.
Uploaded files are validated, not trusted
Files are checked against their actual binary signature, not just their extension, before being accepted anywhere in the system.
What we haven't formalised yet
Consistent with how the rest of this site works: no inflated claims here either. At our current size, the following are not yet in place, and we would rather tell you that directly than let a procurement checklist find out later.
- No third-party penetration test has been commissioned yet
- No SOC 2, ISO 27001 or equivalent certification exists yet
- No formally published sub-processor list exists yet — ask and we will give you the current, real list by email
- No published uptime SLA exists yet
None of this is a reason not to ask. If a security questionnaire needs a "not applicable" or "in progress" answer against any of these, we will fill it in honestly rather than leave it blank.
Security questionnaire or DPA?
Send it to info@gexonai.com with the subject "Security questionnaire" or "DPA request" and we will complete it directly — no generic template standing in for a real answer.
Read the full Data Protection policy →