Security & Ethics
Operational intelligence systems handle sensitive infrastructure data. This page details exactly how we protect it, what standards we follow, and where our ethical boundaries are.
How We Handle Your Data
Every byte of data that flows through our systems is governed by strict policies — from collection to storage to deletion.
Encryption at Rest
All data stored in our systems uses AES-256 encryption. Database-level encryption is enforced across every deployment, with keys rotated on policy-defined schedules.
Encryption in Transit
All communication channels use TLS 1.3. API endpoints enforce HTTPS with HSTS headers. Internal service communication uses mTLS where applicable.
Access Control
Role-based access control (RBAC) with principle of least privilege. All access is logged, auditable, and reviewed. No shared credentials, ever.
Data Minimization
We collect only what's operationally necessary. Sensor data is scoped to the monitoring objective. Personal data is excluded by design.
Retention Policies
Data retention periods are defined per-project. Raw data is purged according to agreed schedules. Aggregated metrics can be retained longer with explicit approval.
Incident Response
Documented incident response plan with defined escalation paths. Clients are notified within 24 hours of any confirmed security event. Post-incident reports are standard.
Ethical Use Policy
Technology is a tool. How it's used matters. These are the principles that govern every engagement.
1No Surveillance of Individuals
Our systems monitor infrastructure, environments, and operational processes — never individuals. We do not build facial recognition, behavioral tracking, or employee surveillance systems.
2Informed Consent & Transparency
Every deployment includes clear documentation of what is being monitored, why, and by whom. Stakeholders are informed before systems go live. No covert monitoring.
3Algorithmic Accountability
When we use statistical models or machine learning, we document the training data, assumptions, limitations, and failure modes. Every automated decision is auditable and explainable.
4Right to Explanation
Any stakeholder affected by our systems has the right to understand how decisions or alerts are generated. We provide plain-language documentation alongside technical specifications.
5Engagement Refusal
We reserve the right to decline any project that conflicts with our ethical standards — including mass surveillance, oppressive monitoring, or systems designed to circumvent civil liberties.
Standards & Compliance Approach
We align with international standards and are transparent about where we are in the compliance journey.
Information security management practices aligned with ISO 27001 framework.
Data processing activities comply with GDPR requirements for EU-related engagements.
Working toward SOC 2 Type II certification for trust service criteria compliance.
Cybersecurity practices structured around NIST Cybersecurity Framework guidelines.
Enterprise Readiness
We understand that large enterprises and organizations have stringent requirements beyond typical commercial engagements. Our approach is designed for this:
Security Questions?
If you have specific security, compliance, or ethics questions about working with Xynak, we're happy to discuss them in detail during a consultation.
Contact Us