Security

What we actually do to secure your data

Written for whoever on your side runs the security review — plain terms, and honest about which parts are formalized today and which are still in progress at our size.

In the product

Application security

The practices below are not aspirational — they are what the current codebase actually does, and they can be verified by anyone we grant code access to as part of a due-diligence process.

Encrypted in transit

Every connection to our systems runs over TLS 1.2+. Nothing is submitted or retrieved over plain HTTP.

Parameterised queries throughout

All database access uses prepared statements. There is no code path that concatenates user input into a query.

Passwords are never stored in the clear

Account passwords are hashed with bcrypt. Login attempts are rate-limited per account with an escalating lockout, and every session is invalidated the moment an account is removed.

CSRF protection on every state change

Every action that changes data — not just forms — is protected by a per-session token, checked server-side before anything is written.

Isolated per client

Connected SolmiriX data lives in its own workspace — never pooled or blended with any other client's data, and never used to train a shared or general-purpose model.

Uploaded files are validated, not trusted

Files are checked against their actual binary signature, not just their extension, before being accepted anywhere in the system.

In plain terms

What we haven't formalised yet

Consistent with how the rest of this site works: no inflated claims here either. At our current size, the following are not yet in place, and we would rather tell you that directly than let a procurement checklist find out later.

  • No third-party penetration test has been commissioned yet
  • No SOC 2, ISO 27001 or equivalent certification exists yet
  • No formally published sub-processor list exists yet — ask and we will give you the current, real list by email
  • No published uptime SLA exists yet

None of this is a reason not to ask. If a security questionnaire needs a "not applicable" or "in progress" answer against any of these, we will fill it in honestly rather than leave it blank.

Security questionnaire or DPA?

Send it to info@gexonai.com with the subject "Security questionnaire" or "DPA request" and we will complete it directly — no generic template standing in for a real answer.

Read the full Data Protection policy →