Security and access

Target minimum for invitations, access factors, community isolation, audit, incidents and supplier risk.

EXPERIMENT / UNTIL FURTHER NOTICE

Experimental mode until further notice. XIXOUT is experimental community software, not a financial service. Synthetic DEMO data in the public preview is distinct from real external tokens.

To the maximum extent permitted by applicable law, XIXOUT is provided in experimental mode on an “as is” and “as available” basis. It may contain errors and may be changed, restricted, suspended or discontinued at any time. To that same legally permitted extent, no warranty is given as to accuracy, completeness, availability, fitness for a particular purpose, uninterrupted operation or security. No content constitutes financial, investment, legal, tax or regulatory advice, an offer, a market, a licence, an approval or a third-party endorsement. Content or availability must not be relied on as the sole basis for any real-world decision.

No warranty. No right to rely.

To the maximum extent permitted by applicable law, the operator is not liable for indirect, consequential or purely economic loss arising from reliance on experimental content or temporary unavailability. Nothing in these terms excludes or limits liability that cannot lawfully be excluded or limited, including liability protected for consumers or weaker parties and liability for death or personal injury caused by negligence where applicable. The precise regime depends on the operator, the user, the governing law and the circumstances.

Pilot conditions

A confirmed operator does not replace professional review.

The operator is XIXOIO LTD; the confirmed, monitored contact for support, privacy and security is info@xixoio.com. The operator's pilot approval does not replace evidence of applicable legal, privacy, security and operational conditions or professional review of these drafts.

Mandatory review

EU/Czech counsel + DPO; UK counsel where in scope

This document is a product and compliance draft, not legal advice or approved final wording. Before an external pilot it requires review by qualified EU/Czech counsel and a DPO and, for UK users, by qualified UK counsel.

01threat model, authentication and account recovery
02server-side community isolation and audit trail
03independent security testing and incident response

1. Status of the security framework

This document defines a target minimum, not a certification, penetration test, security warranty, compliance statement or evidence that every control is deployed. Public claims may describe only a verified state.

A threat model, data classification, authorisation matrix, recovery test, incident plan and independent review are required before the pilot. The operator is XIXOIO LTD; the confirmed, monitored contact for support, privacy and security is info@xixoio.com. The operator's pilot approval does not replace evidence of applicable legal, privacy, security and operational conditions or professional review of these drafts.

2. Invite-only access and verification

01public self-registration is disabled; an invitation specifies the identity, community, role and period
02an invitation is one-time, limited, revocable and cannot activate another email identity
03an identity provider is only a verification step, not a partnership or endorsement
04native TOTP Authenticator is the mandatory second factor; email verification alone does not create AAL2, and no SMS or phone number is required
05the current session must have native AAL2 with a verified TOTP factor; sensitive commands also require recent TOTP and a separate entitlement, while ordinary reading has no recurring ten-minute verification interval
06a password is created only after verification and stored using secure one-way derivation
07sensitive actions require fresh multifactor authentication, controlled sessions and secured recovery

3. Community isolation and least privilege

Every authorisation is checked server-side against user, community, company, object and action. A URL, identifier or client-side role label creates no access. The default is deny.

Platform admin, company admin, member, institutional observer, moderator, support and AI have separate permissions. A token grants no human role. Service accounts have a limited purpose, short lifetime and no shared human credentials.

4. Data and secret protection

01evidenced current TLS and appropriate encryption of sensitive stored data
02secrets and cryptographic keys kept out of code, client bundles, chat and logs, with rotation and least privilege
03tests showing logs exclude passwords, verification codes, full session tokens, private content and excess data
04separated encrypted backups, a retention regime and a successful recovery test
05no end-to-end encryption claim without an architecture in which the operator truly cannot decrypt content
06no claim that target controls operate externally until evidence is complete, and no guarantee of absolute security

5. Audit, detection and incident response

Security events include invitation issue and acceptance, sign-in, recovery, role changes, sensitive access, export, moderation and administration. The audit trail must be time-consistent, tamper-resistant and available only to authorised control functions.

Before the pilot there must be contacts, incident classification, containment, evidence preservation, recovery, learning and assessment of notification duties based on the real operator, data and applicable framework.

6. Secure development and suppliers

01peer review, automated tests, dependency checks, static analysis and separated development, staging and production
02no real personal or confidential data in public previews, test fixtures, screenshots or repositories
03change evidence, release approval, rollback and verified backups before risky changes
04supplier diligence covering access, locations, subprocessors, incidents, contracts and exit plan
05independent penetration testing and negative isolation tests before an external participant

7. Participant duties and vulnerability reporting

Participants protect devices, use unique passwords, do not disclose codes and promptly report lost access, suspicious sign-ins or accidental exposure. They must not run destructive tests, use social engineering or obtain another person's data.

The monitored contact info@xixoio.com accepts security reports. Do not send passwords, TOTP codes, pairing keys or another person's private content. Coordinated-disclosure rules, response times, verified account recovery and emergency escalation remain operational conditions requiring evidence, not guarantees created by an email address.