Security

Xyreka separates organisation knowledge, private project submissions and architecture-board discussion through application-level permissions. Access is checked on the server, not inferred from a menu, job title, email provider or email domain.

Security controls

• Google, Microsoft and verified-password sign-in, with current account and session checks.
• Explicit knowledge, project and board assignments. Team administration is separate from private-content access.
• Published guidance and submitted packs are immutable; later revisions do not rewrite earlier history.
• Internal board notes are excluded from project responses and exports. Clarifications are released separately.

Data handling

Organisation knowledge stores draft and published text. Private project intake retains section responses, text evidence and the exact published guidance used in a submission. Reference URLs are not automatically fetched or archived. The public site is served over HTTPS.

Current boundaries

The pilot shares an application process and database infrastructure. These permission boundaries are not separate service, database or storage isolation. Organisation SSO, assignable custom roles, private file uploads and formal architecture decisions are not available yet.

Xyreka supports a review process; it does not certify a design or guarantee compliance. Contact support@xyreka.com to report a security concern. Do not include passwords or private project documents in your first message.

For detailed commitments and legal terms, review our Privacy and Terms pages.