Security
What we actually do to protect your data.
Written for whoever runs the security review on your side — in plain terms, and honest about what is formalised today and what is not yet, at our size.
Your data, end to end
- Your systemsOnly the sources you explicitly authorise
- Encrypted connectionTLS 1.2+ on every connection
- Isolated workspaceNever pooled with another organisation’s data
- Controlled accessHashed credentials, rate-limited logins, CSRF-protected changes
- Deletion on requestSee our data protection policy for timelines
01 In the product
Application security, as it is today.
These are not aspirations. They describe what the current codebase does, and can be verified by anyone we grant code access to during due diligence.
Encrypted in transit
Every connection to our systems runs over TLS 1.2 or later. Nothing is submitted or retrieved over plain HTTP.
Parameterised queries throughout
All database access uses prepared statements. No code path concatenates user input into a query.
Passwords never stored in the clear
Account passwords are hashed with bcrypt. Logins are rate-limited per account with an escalating lockout, and sessions end the moment an account is removed.
CSRF protection on every change
Every action that changes data is protected by a per-session token, checked server-side before anything is written.
Isolated per organisation
Connected SolmiriX data lives in its own workspace — never pooled or blended with another organisation’s data, and never used to train a shared or general-purpose model.
Uploaded files validated, not trusted
Files are checked against their actual binary signature, not just their extension, before being accepted anywhere.
02 Plainly
What we have not formalised yet.
At our current size, the following are not in place. We would rather tell you directly than let a procurement checklist find out later.
- No third-party penetration test has been commissioned yet.
- No SOC 2, ISO 27001 or equivalent certification exists yet.
- No published sub-processor list yet — ask and we will send the current, real list by email.
- No published uptime SLA yet.
None of this is a reason not to ask. If a questionnaire needs “not applicable” or “in progress” against any of these, we fill it in honestly rather than leave it blank.
03 Due diligence
Security questionnaire or DPA?
Send it to info@gexonai.com with the subject “Security questionnaire” or “DPA request” and we will complete it directly — no generic template standing in for a real answer.
Questions your security team needs answered first?
Bring them to the discovery call, or send them ahead in writing. Either way, you get specific answers.