How Elixion handles security and your data

• SOC 2: we are preparing for an audit. It has not started, and no report exists yet. Email security@elixion.ai for our current control status.
• GDPR / UK GDPR / CCPA: we operate as a processor under your control. Request our DPA template under Policies below for the contractual terms.
• Third-party penetration test: being scoped, with a vendor request for proposal in progress. No report yet.

• Encryption in transit: TLS 1.2+ for all customer traffic.
• Encryption at rest: the database is encrypted at rest by our managed database provider (DigitalOcean); integration tokens, OAuth secrets, and webhook tokens are additionally encrypted at the application layer (Fernet).
• Access: MFA is required for every administrative account; organizations can enforce MFA and OIDC single sign-on for all members; signing-key rotation and per-session token revocation.
• Audit trail: security-relevant events are recorded in an audit log, kept 90 days, with a nightly encrypted, checksummed export to separate object storage. The log is not yet append-only or tamper-proof; that work is tracked. Coverage is selective rather than total: the events that are emitted are recorded, and the log is not a complete transcript of every action in the product.
• Backups: daily encrypted database backups, 30-day retention, and an automated restore drill that runs monthly.
• Right to be deleted: every user can request account deletion via POST /api/v1/users/me/erase. PII is anonymized, credentials revoked.

We use a small number of well-known infrastructure and SaaS sub-processors. The current list, with region, purpose, and DPA status, is available on request:

Request the sub-processor list

We commit to giving at least 30 days' notice before adding or replacing a sub-processor. To receive notifications, email security@elixion.ai with the subject “sub-processor notifications”.

We send each policy below on request, usually within two business days. Click one to open a pre-filled email.

• Code of Conduct + Ethics + Whistleblower Policy (available on request)
• Data Classification (available on request)
• Data Processing Addendum (template) (available on request)
• Incident Response runbook (available on request)

We take ethics, safety, and security concerns seriously, and we protect anyone reporting in good faith from retaliation. You have four routes; use whichever you are most comfortable with.

1. Tell your manager (for Elixion personnel) or our CEO directly.
2. Email ethics@elixion.ai, which goes to the CEO and the board chair. Acknowledgement within two business days.
3. Anonymous form: third-party hosted, strips identifying metadata. (Form provisioning in progress; until live, the email channel above or a paper letter to the address on the policy page is the anonymous fallback.)
4. External authorities: nothing in our policies restricts you from reporting suspected illegal conduct to a regulator or law-enforcement agency.

Full policy: Code of Conduct + Ethics + Whistleblower Policy (available on request).

Completed questionnaires and our control status are available under a mutual NDA. Email security@elixion.ai with your company name and a contact. We typically respond within two business days.