Security at XCubes

XCubes holds your financial models, so this page says exactly how we store, protect and process them. Everything here describes what is in place today. Where something is not in place yet, we say so.

Last updated: 2026-09-17

Where your data lives

• Microsoft Azure, West Europe (Netherlands). The application, database, file storage and telemetry all run in that region. We treat a region change as a breaking change, not a routine one.
• Encrypted in transit. Connections to XCubes use TLS 1.2 or higher, and HSTS is enabled. The application talks to the database over TLS only.
• Encrypted at rest. The database (Azure Database for PostgreSQL) and file storage (Azure Blob Storage) are encrypted at rest with 256-bit AES.
• Backed up daily, with 7-day point-in-time restore.
• Not exposed. The database is firewalled to connections originating inside Azure and requires TLS; its credentials live in the application's configuration, never in code. Uploaded files sit in a private container with public access disabled, reached through a managed identity rather than a shared key.

Your account

• Sign in with Google or Microsoft, or with email and password.
• Passwords are hashed with bcrypt and are never stored or logged in clear.
• Sessions are short-lived. An access token lasts 15 minutes and is renewed by a refresh token that rotates on every use. A refresh token presented twice invalidates the whole session — that is how a stolen one is caught.
• Changing or resetting your password signs out every device and revokes every API key issued to your account.
• Sign-in attempts are throttled per client to slow down password guessing.
• API keys (for the MCP integration) are shown once, stored only as a SHA-256 hash, and can carry an expiry. Keys issued through the OAuth flow expire after 90 days.
• Delete your account yourself, at any time. Deletion removes your account, the projects you own and every file they uploaded. Guest accounts created via "Explore without an account" are deleted automatically after 14 days of inactivity.

Who can see your models

• The project is the isolation boundary. Every request is checked against the project it names, and every resource inside it — cube, dimension, table, dashboard, link, file — is verified to belong to that project before it is read or written. This boundary has its own test suite, run on every change.
• Four roles: owner, admin, editor, viewer. Only an owner can delete a project.
• Access rules scope a collaborator to their slice of a cube — a regional manager sees and edits only their region. Owners always see everything.
• Sharing is explicit. Cubes and dashboards are shared to named people, and a shared dashboard can be limited to specific pages. Nothing is shared by default.
• Public links are unguessable (128-bit random), can carry an expiry, can be limited to specific pages, and can be revoked at any time. Before one is created, XCubes lists every cube the link would expose and asks you to confirm.
• XCubes staff do not open customer projects except to resolve a support request you raised or an incident affecting your account.

Connections to your systems

• Connector credentials are encrypted with AES-256-GCM before they are stored, and are never sent back to the browser — the interface shows masked values.
• SQL connections are read-only. Queries are validated to contain no data-modifying statement anywhere in their text, identifiers are checked before they are quoted, and on PostgreSQL the session itself is pinned read-only.
• XCubes never connects to private networks. Every outbound connection — SQL, URL import, Odoo — is resolved first and refused if it points at a private, loopback, link-local or cloud-metadata address.

AI features

• Model provider: Anthropic. XCubes uses Claude through Anthropic's commercial API, under terms that exclude customer data from model training.
• What is sent: your request, the structure of the project you are working in (dimension and item names, formulas, how cubes are wired) and the data the specific task needs — not your whole database.
• Same permissions as you. The assistant works inside the project you are in, with your role. It cannot read or change anything you could not.
• Proposals before writes when it builds for you: a model proposed from the Excel Health Check is shown as a full set of changes that you approve before anything is written.
• Files attached to a chat are deleted after 24 hours.

Our public tools

• Excel Health Check analyses your workbook in your browser. The file is never uploaded. What we record is a grade, counts and feature labels — never cell values, sheet names or file names. If you choose the optional AI step, a masked skeleton (structure and formula patterns, values masked in the browser) is sent once and not stored.
• Odoo Readiness Check connects to your Odoo instance from our servers for the duration of one request. The credentials you enter are never stored, never logged and never sent to telemetry. The report we keep is anonymous: a band, an Odoo version and counts.

How we build

• Every change is reviewed and gated. A pull request cannot merge until type checks, several thousand automated tests (including the tenant-isolation suite) and integration tests against a real database pass. Production is deployed from that reviewed branch.
• Secrets and dependencies are scanned on every pull request. Committed secrets are caught by gitleaks; production dependencies are audited, and an unreviewed high or critical advisory blocks the merge.
• Structured security reviews of the whole codebase — three in 2026 so far — with every finding tracked to closure.
• Logs are redacted. Credential-bearing parameters never reach logs, and error responses never echo database queries or their parameters.
• Security headers — HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy — are set on every response.

Sub-processors

What we don't have yet

We would rather you read it here than find it in a questionnaire.

• Multi-factor authentication is not yet available in XCubes itself. Sign in with Google or Microsoft to get MFA from your identity provider today.
• No third-party penetration test or SOC 2 / ISO 27001 certification yet. Our security reviews are internal.
• Activity log, not audit log. Projects keep a log of who changed what; it is not yet tamper-evident.

Reporting a vulnerability

If you believe you have found a security issue, email security@xcubes.com. We read every report, reply within two business days, and will not pursue good-faith research. Please do not access data that is not yours or degrade the service while testing.