Security
Security is built into Xecodai from the database up. This page summarises the technical and organisational controls we use to protect your data.
Encryption
All traffic is encrypted in transit with TLS. Data at rest is encrypted in the database and object storage. Credentials and secrets are stored encrypted and never exposed to the client.
Authentication
We use managed authentication with secure session tokens. You can enable multi-factor sign-in via your identity provider. Sessions expire automatically and can be revoked by signing out.
Row-level data isolation
Every user-scoped table is protected with row-level security policies, so a user can only read or write their own data. Server-side privileged actions verify identity before any elevated operation.
Least-privilege access
Service roles that bypass policies are confined to server functions and are never shipped to the browser. Admin access is checked server-side against a dedicated roles table, never via client storage.
Voice and camera data
Interview recordings are processed only during an active interview and are tied to your account. You can delete your recordings at any time; deletion is propagated from storage and the database.
Monitoring and incident response
We monitor the platform for errors and anomalies. Suspected incidents are triaged, affected users are notified where relevant, and post-incident reviews drive fixes.
Responsible disclosure
If you believe you have found a security issue, please report it responsibly to security@xecodai.com. Do not disclose it publicly until we have reviewed and addressed it.
Your part
Use a strong, unique password, enable multi-factor where available, and revoke microphone or camera permission when you are not actively interviewing.