Security & data ownership
XaaX is designed to support GDPR-aligned business use: EU-region data infrastructure, encryption in transit and at rest, configurable retention and access controls — and your company always owns its data.
Workspace isolation
- Each company runs in an isolated workspace — business data is stored in tenant-scoped collections, physically separated per company.
- Every server-side operation is bound to the authenticated user's workspace; workspace identifiers are never accepted from the client.
Access control & authentication
- Role-based access with a per-module permission matrix, enforced server-side on every API route.
- Passwords are hashed with bcrypt; sessions use secure, signed JWT cookies.
- Password reset links are single-use and expire after one hour.
- Separate permissions govern recording meetings, viewing transcripts, approving outputs and deleting recordings.
Auditability
- An audit log records important actions per workspace: user changes, role changes, plan changes, module changes and meeting recording/processing/deletion events.
- Billing events are logged without sensitive payment data — XaaX never stores card or bank credentials; payments are processed by Mollie.
Retention, export & ownership
- Your business data belongs to your company. We do not sell customer data.
- Data can be exported in common formats (PDF, Excel).
- Meeting audio has configurable retention and can be permanently deleted independently of the meeting record.
Meetings & AI processing
- Recording state is always clearly visible — there is no hidden background recording.
- Your organisation configures its own recording notification/consent text; recording lawfully is the customer's responsibility as controller.
- AI processing of meeting audio is configurable, and AI-generated drafts require human approval before they become records.
- Recordings are stored under non-public paths and served only through authenticated, permission-checked requests.
Infrastructure: XaaX runs on Vercel with data stored in MongoDB Atlas (EU region) and files in EU-hosted object storage. Payment processing is handled by Mollie B.V. (Netherlands). For security questions or responsible disclosure, contact hello@osteam.nl.