Security at xpntl

Security is a first-class part of the product, not a bolt-on. This page describes the controls that protect your workspace today. Have a question or a report? Email security@xpntl.ai.

Encryption

In transit. All traffic to xpntl.ai, app.xpntl.ai, and api.xpntl.ai is served over HTTPS (TLS 1.2+), with HSTS. The API, web app, and MCP server never accept plaintext connections.
At rest. Your data lives in Azure Database for PostgreSQL and Azure Blob Storage, both encrypted at rest with AES-256 by the platform.

Tenant isolation

Every workspace's data is isolated at the database layer with PostgreSQL Row-Level Security. The application connects with a non-owner role that cannot bypass those policies, so a query can only ever see rows belonging to the current workspace. Isolation is enforced by Postgres itself, not just by application code.

Authentication & sessions

Passwords are salted and hashed with a modern algorithm; we never store or log plaintext passwords.
Single sign-on with Google, GitHub, Microsoft, and Apple.
Multi-factor authentication (TOTP) and passkeys (WebAuthn) for phishing-resistant login.
Sessions are carried in HttpOnly, Secure, same-site cookies, not readable by JavaScript. You can view every active session and revoke any of them (or sign out everywhere) from Settings, and workspace admins can force-sign-out every member of a workspace.
Agent & API access uses scoped API keys, harness keys, and OAuth 2.1 (PKCE, S256) for MCP connectors, each independently revocable.

Access control

Workspace membership is role-based (Owner, Admin, Member, Guest) and enforced on every mutation. Administrative actions (billing, member management, integrations, audit, data export) require an Admin role or higher.

Application security

SSRF protection. Every outbound request the platform makes on your behalf (webhooks, MCP client-metadata fetches) is restricted to public HTTPS hosts, with per-redirect re-validation and DNS-rebinding defenses.
Signed webhooks. Outbound webhook deliveries are HMAC-SHA256 signed with a per-endpoint secret so receivers can verify authenticity; deliveries are retried with backoff and shown in an observable delivery log.
Input validation. All API inputs are schema-validated at the edge.
Content safety. Uploaded files are served from an authenticated origin with X-Content-Type-Options: nosniff and a restrictive sandbox, and rich-text content is sanitized to prevent stored XSS.

Auditability

Every authentication, administrative, and data-export event is recorded in a per-workspace audit log that admins can filter and export (CSV/JSON), free on every plan.

Data ownership & portability

Your data is yours. Admins can export the full workspace at any time: a structured JSON snapshot of every collection, plus a .zip archive that bundles attachment files, so you are never locked in. xpntl is also self-hostable if you want to run it on your own infrastructure.

Infrastructure

xpntl runs on Microsoft Azure (Container Apps for the API/MCP services, Azure Database for PostgreSQL, and Azure Blob Storage), managed platforms that receive security patching and monitoring. Application deploys go through automated migration validation and a health-checked rollout.

SOC 2

We are formalizing our controls toward a SOC 2 Type II attestation. Many of the underlying controls described on this page are already in place. If you need our current status or documentation for a security review, contact security@xpntl.ai.

Reporting a vulnerability

We welcome responsible disclosure. If you believe you've found a security issue, email security@xpntl.ai with details and reproduction steps. Please give us a reasonable window to remediate before any public disclosure. We do not pursue legal action against good-faith security research.