Our own posture,
in the open
Selling a security product is an odd thing to do badly. Xee Security's own ISMS runs inside Xee Security, and the controls below are how the platform holding your evidence is actually built — not a list of intentions.
How the platform is built
Tenant isolation, enforced
Every tenant-owned record — controls, risks, policies, assets, suppliers, training, evidence, findings — is filtered by tenant at the data layer, not in page code. Cross-tenant direct object references return a 404, and that is verified with a two-tenant test.
A.8.3Nonce-based CSP
A per-request content security policy with default-src 'self', object-src 'none' and frame-ancestors 'none'. No inline handlers anywhere in the app.
A.8.26Password handling
PBKDF2 with a per-user salt, from the platform's own cryptography library. No third-party identity package sitting between us and your credentials.
A.8.24Rate-limited credentials
Login, register, forgot and reset are capped per IP per minute, with a generous global ceiling for ordinary browsing. Flood testing returns 429s as designed.
A.8.20Hardened session cookie
HttpOnly, SameSite, Secure in production, with an eight-hour sliding expiry — and an email-verification gate before an account can sign in at all.
A.5.17CSRF on every mutation
Antiforgery validation on all state-changing requests by default, and payment notifications verified by signature rather than trusted on arrival.
A.8.26Evidence integrity
Every uploaded artefact is SHA-256 hashed on capture. The hash is what makes the auditor and forensics chain-of-custody views meaningful.
A.8.15Full audit trail
An immutable in-app log of who changed what and when — including every tool call and every block during an AI validation run.
A.8.15Plan-based authorisation
Plan limits are enforced server-side across the app rather than hidden in the UI, so a tier boundary is a real boundary.
A.5.15POPIA, in the plumbing
South African data protection isn't a page in the terms — it shapes how the product stores, shares and deletes what you put in it.
- Terms, Privacy and a Data Processing Addendum, with consent recorded at signup
- Sub-operator position stated, including international transfers
- Return-or-deletion obligations on termination
- Data-protection key ring persisted so encrypted tenant keys survive restarts
- Backups held on a separate, daily-backed-up host
- Health endpoints and a public status page for transparency during an incident
Where we stand, honestly
- ISO/IEC 27001:2022
- The platform is built to the 2022 Annex A control set and our own ISMS runs inside the product. We publish our readiness rather than claiming a certificate we don't hold.
- POPIA
- Aligned, with the security-safeguard obligations mapped to the controls that satisfy them. Our legal templates are clearly marked as templates pending South African attorney review.
- Payments
- Card data never touches our systems. Subscriptions and engagement invoices are processed by PayFast, with payment notifications validated by signature.
- Penetration testing of Xee itself
- The platform is tested with the same engine and the same rules of engagement we apply to client work, and findings land in our own control register.
- Availability
- Liveness and readiness endpoints wired to monitoring, with a public status page at app.xeesecurity.com/Status.
- Disclosure
- Found something? Mail security@xeesecurity.com. We'll acknowledge, keep you updated, and credit you if you'd like to be named.
Why say all this out loud? Because it's the same argument we make to your customers on your behalf. A posture page that only claims good news teaches buyers to ignore posture pages. Publishing the real state — including what's still in progress — is what makes the rest of it credible.