Trust Center

Trust & Security at Xiilio

TRUST & SECURITY

Specifics, not adjectives. Architecture, data flow, encryption, access, retention, subprocessors, backups, incident response, AI data usage and certifications — including the ones we don't hold.

How We Protect Your Data

SECURITY BY DESIGN

Built on a secure foundation so your data and your clients' data stay protected at every layer.

UK GDPR & PECR

ICO-registered controller. Records of processing activity and a signed DPA for every client.

Encryption

TLS 1.2+ in transit, AES-256 at rest on the managed database, storage and backups. No end-to-end encryption claim.

Access Control

Row-level security per client, roles held in a separate table, append-only admin audit log.

Named Subprocessors

Every vendor that can touch your data is listed by name below — hosting, models, voice, payments and email.

AI Data Usage

No model training on client data. Agents can't quote, contract or commit without human approval.

Logging & Alerting

Error reporting and auth-anomaly alerts. Not a 24/7 staffed security operations centre — we say so.

Full disclosure

WHAT WE ACTUALLY HAVE

Adjectives are cheap, so here is the detail instead: architecture, data flow, encryption, access, retention, subprocessors, backups, incident response, AI data usage, residency, testing and certifications. Where we don't have something — no SOC 2, no penetration test report, no uptime SLA — it says so on the same line.

In place
Documented
Not held
On request
Planned

Architecture

Xiilio is a browser-based application with a managed Postgres backend and serverless functions. There is no Xiilio-operated hardware.

Front end: Static React application served from the hosting provider's CDN. No customer data is stored in the bundle.
Application backend: Managed Postgres (Supabase, via Lovable Cloud) with row-level security on customer-facing tables, plus serverless edge functions for booking, chat, payments and webhooks.
Self-hosted infrastructure: None. Xiilio operates no owned servers, colocation or on-premise equipment.
Environment separation: Separate test and production databases with separate credentials. Production data is not copied into test.

Data flow

Where your data physically goes, in order, from the moment a visitor or record enters the system.

Website enquiries: Browser → Xiilio edge function → Postgres record → notification email to Xiilio. Optionally forwarded to your CRM when you have asked us to connect one.
Voice and chat conversations: Handled by the voice/AI providers listed under Subprocessors. Transcripts and summaries are written back to the Xiilio database; audio retention is controlled by the voice provider's settings.
Client campaign data: Read from the advertising, CRM and analytics accounts you authorise, via OAuth. Xiilio stores derived metrics and identifiers, not full copies of your CRM.
Payments: Card details are entered on Stripe-hosted pages and never touch Xiilio systems. We store the Stripe customer and subscription identifiers only.

Encryption

Encryption is provided by the managed platforms we run on. We are describing their standard behaviour, not a bespoke Xiilio implementation.

In transit: TLS 1.2 or higher on every public endpoint. HSTS enabled.
At rest: AES-256 disk encryption on the managed Postgres database, object storage and backups, as provided by the platform.
Application-layer / end-to-end encryption: Not implemented. Xiilio staff with production access can read stored records; we do not claim zero-knowledge or end-to-end encryption.
Key management: Encryption keys are managed by the platform provider. Xiilio does not operate its own KMS or hold customer-managed keys.
Secrets: API keys and webhook signing secrets are held in the platform secret store, never in source control, and are rotated when staff or vendors change.

Access control

Who can reach production data, and what stops everyone else.

Row-level security: Customer-facing tables enforce row-level security so a signed-in client can read only their own records. Admin capability is granted through a separate roles table, never a flag on the user record.
Staff access: Production access is limited to the founder and the technical lead. There is no wider support team with standing database access.
Audit logging: Administrative actions in the Xiilio admin area are written to an append-only audit log with actor, action and timestamp.
Formal access reviews: No scheduled quarterly access-review process is documented yet. Access is reviewed when a person or vendor changes.

Authentication

How accounts are protected on both the client and admin side.

Sign-in methods: Email and password, Google, and Apple sign-in. No anonymous accounts.
Password protection: New and changed passwords are checked against the Have I Been Pwned breached-password corpus and rejected if compromised.
Multi-factor authentication: Time-based one-time codes (TOTP) are supported and can be enabled on administrative accounts. MFA is not enforced for every login.
Session handling: Sessions expire after 30 minutes of inactivity; tokens are rotated on refresh.
SSO / SAML for clients: Not available. We do not offer enterprise SSO today.

Data retention

What we keep, for how long, and how you get it deleted without asking twice.

Client account and CRM records: Retained for the life of the contract and for 12 months afterwards, then deleted unless you ask us to delete sooner.
Conversation transcripts: Retained for 12 months to support quality review and dispute resolution, then deleted.
Analytics events: First-party page and conversion events retained for 14 months in aggregate form.
Deletion on request: Self-serve account deletion is available at /delete-account. Written erasure requests are actioned within 30 days.
Backup deletion lag: Deleted records can persist in encrypted backups for up to 30 days before backup rotation removes them.

Subprocessors

Every third party that can process customer data on our behalf. If a vendor is not on this list, it does not have your data.

Lovable (hosting) & Supabase (database, auth, storage, functions): Application hosting, database, authentication and file storage.
Google (Gemini models, via the platform AI gateway): Language-model inference for chat and agent reasoning.
Vapi, with Deepgram and ElevenLabs: Voice agent orchestration, speech-to-text and text-to-speech for ARIA voice calls.
Stripe: Payment processing and subscription billing. PCI DSS Level 1 service provider.
Resend: Transactional and notification email delivery.
GoHighLevel: CRM routing for enquiries where the client uses it. Not used for clients on other CRMs.
Google Analytics 4: Website analytics, loaded only after consent, with Consent Mode v2 and IP anonymisation.
Change notice: We will tell existing clients by email before adding a subprocessor that handles their data.

GoHighLevel (CRM Infrastructure)

How the CRM platform's third-party attestations relate to Xiilio's own controls.

Enterprise CRM layer: Our CRM layer runs on GoHighLevel Enterprise, which holds SOC 2 Type II certification (audited annually under AICPA standards) and ISO/IEC 27001:2022 certification, covering its cloud infrastructure, encryption, access control and incident response. We connect to it via a scoped API key, monitored and governed through our own Vanta compliance program — so the platform's third-party attestations sit alongside our own controls, not in place of them.

Backup

What is backed up, how often, and what we have actually tested.

Database backups: Automated daily backups retained by the managed database platform, plus a nightly Xiilio-run export to a private storage bucket.
Point-in-time recovery: Available on the managed database platform.
Restore testing: Restores have been performed ad hoc, not on a documented schedule with recorded results. We are not going to claim a tested annual restore drill we have not run.

Incident response

A small company's incident process, written down honestly rather than dressed up as a security operations centre.

Reporting a vulnerability: security.txt is published at /.well-known/security.txt. Disclosures go to letsgo@xiilio.ai and are acknowledged within one business day.
Breach notification: Personal-data breaches are assessed and, where the threshold is met, reported to the ICO within 72 hours and to affected clients without undue delay.
On-call rotation: There is no 24/7 staffed on-call rota. Alerts route to the founder and technical lead; response is best-effort outside UK business hours.
Monitoring: Application error reporting and database/function logs with alerting on failures and authentication anomalies. This is logging and alerting, not a managed threat-detection service.

Disaster recovery

What we would actually do if the platform went down.

Recovery approach: Redeploy the application from source control and restore the database from the most recent backup or point-in-time snapshot.
Target objectives: Working targets are a 24-hour recovery time and a 24-hour recovery point. These are targets, not contractual commitments.
Uptime guarantee: No uptime SLA is offered and no availability percentage is published. Availability depends on the underlying platforms, whose own status pages are public.
Multi-region failover: Not implemented. The application runs from a single primary region.

AI data usage

What happens to your data when it passes through a model — the question most AI vendors answer vaguely.

Training on your data: Xiilio does not train models on client data, and we use model providers under terms that exclude API content from provider training.
What is sent to a model: Conversation text, the business knowledge you configure, and relevant CRM fields needed to answer. We do not send payment details or authentication credentials.
Human review: Xiilio staff review conversation transcripts for quality and safety. Reviews are logged.
Model output limits: Agents cannot send contracts, quote prices outside your configured list, or commit your business without a human approval step.
Special category data: The platform is not configured for health, biometric or criminal-offence data. Do not put it into an agent.

Model providers

The named models behind the agents, so you can assess them yourself.

Text and reasoning: Google Gemini models, accessed through the platform AI gateway. Model versions change as providers update them; the current version is available on request.
Speech-to-text: Deepgram, via Vapi.
Text-to-speech: ElevenLabs, via Vapi.
Self-hosted or private models: Not offered. Every model call goes to a third-party provider listed above.

Data residency

Where the data sits, and where it can travel.

Primary storage region: The production database and file storage run in a single cloud region. The specific region is confirmed in writing during procurement.
Model inference location: Model and voice providers may process requests in the United States. Transfers rely on the UK IDTA / EU standard contractual clauses in those providers' terms.
EU/UK-only processing guarantee: Not available. We cannot guarantee that no data leaves the UK/EEA while third-party model providers are in the path.

Penetration testing

What has and has not been tested by whom.

Independent penetration test: None commissioned to date. There is no third-party pen-test report to share, and we will not imply otherwise.
Automated scanning: Dependency vulnerability scanning and platform security linting run against the codebase and database configuration, with findings tracked to resolution.
Headers and transport hardening: Content Security Policy, frame-ancestors clickjacking protection, HSTS and referrer policy are configured and can be verified externally.
Bug reports: Responsible disclosure welcomed via security.txt. No paid bug-bounty programme is running.

Certifications and insurance

The short version: one registration we hold, several standards we do not. Anyone claiming otherwise is guessing.

ICO registration: Registered with the UK Information Commissioner's Office as a data controller. Verifiable on the public ICO register.
ISO 27001: Not certified. No certification is in progress.
SOC 2: No SOC 2 Type I or Type II report exists.
Cyber Essentials: Not certified.
UK GDPR and PECR: We operate under UK GDPR and PECR, maintain records of processing activity, and sign a data processing agreement with every client. Compliance is a legal obligation we meet — it is not a certification.
Professional indemnity insurance: Available on request: cover confirmation and the certificate are shared with procurement during onboarding.

Something missing that your procurement process needs? Ask for it directly — we would rather answer a hard question than publish a vague one.

Agent Monitoring & Logging

HOW WE MONITOR AND LOG AGENT ACTIVITY

An autonomous agent you cannot inspect is a liability. Every action a Xiilio agent takes is recorded — what it did, why it did it, what it touched, what it cost and who signed it off. Nine signals are captured whether the action succeeded, waited, was blocked or failed.

Timestamp, agent and task

Every action an agent takes, timestamped to the second, with the agent, the customer workspace, the trigger that started it and the run it belongs to.

Without a complete log there is no way to answer 'what happened on the 14th' six months later.

Input and data sources

What the agent was given to work with, and every system and dataset it read during the run.

A decision can only be audited if you know what the agent could see when it made it.

Decision summary and evidence

One plain sentence stating the decision, and the checkable facts it rested on. Never raw model chain-of-thought.

A score with no explanation cannot be challenged, corrected or defended to a regulator.

Tools used and action taken

Each system the agent touched, what it asked for, what came back, how long it took, and what the agent then did or was stopped from doing.

Most agent failures are integration failures. The tool call is where you see them.

Policy checks

Every guardrail evaluated on the run — consent, suppression, spend caps, scope, data residency — with the result of each.

Showing the check ran and passed is the difference between compliance and a claim of compliance.

Confidence and risk class

A confidence figure on every decision, the risk class of the action, and the threshold that decided whether it ran, waited or escalated.

Confidence is what lets you automate routine decisions and route the rest to a human. Where the threshold sits is your choice, set per action type.

Human approval

The rule that required approval, who decided, what they decided, when, and any note they left.

This is the accountability record. Named person, timestamp, decision.

Outcome and error status

What the action produced — a reply, a booked meeting, a CRM update, a budget shift, nothing at all — and the error if it failed.

Activity is not achievement. Outcome is the only measure worth reviewing.

Cost, model and version

Model spend for each individual action, the token counts in and out, and the exact model version running when the decision was made.

Autonomous systems get expensive quietly, and when behaviour changes the model version is the first thing to check.

WHAT DID MY AI DO TODAY?

Every action, filtered how you need it, with four dashboards reading the same records. Open any action to see the decision, the evidence behind it, every system it touched, the policy checks it passed and what it cost — then replay the whole run step by step. The activity below is an illustrative demonstration, not a client's record.

Actions taken

Needing a person

Model cost

£7.33

Tokens used

803,500

Agent

Customer

Date

Risk

Outcome

Error

Human approval

Cost — at least £0.00

Showing 14 of 14 recorded actions.

Why did the agent do this?
Ranked 31 of 136 new accounts above the fit threshold and queued them for review; no account was contacted.
Evidence
- 12 of the 148 accounts already existed in the CRM and were removed before scoring.
- 129 of the remaining 136 returned firmographic and technology data; 7 had none and were parked, not scored.
- Fit weights were derived from closed-won patterns over the last 18 months, not set by hand.
- 31 accounts scored above the fit threshold agreed with the customer.
Decision summary and evidence only. Raw model chain-of-thought is not captured or shown.
Input
148 accounts added to the source list overnight, plus the ICP definition and 18 months of CRM history.
Trigger
Scheduled — daily account refresh, 06:00
Data sources accessed
- CRM · accounts
- CRM · closed-won history
- Enrichment provider
- Company register
Action taken
Created 31 ranked accounts in the CRM with the fit reasoning attached to each.
Policy checks
- PassData source licensingAll enrichment drawn from licensed and public sources.
- PassNo contact without approvalScoring only — outreach requires a separate approval.
- PassData residencyProcessing stayed within the customer's configured region.
Tools used
- CRM · searchMatch 148 domains against existing accounts → 12 matches found2.1s
- Enrichment · lookupFirmographics and technology for 136 domains → 129 enriched, 7 no data41.6s
- CRM · writeCreate 31 ranked accounts with fit reasoning → 31 created8.9s
Outcome
31 accounts queued for review. No contact attempted — outreach requires a separate approval.
Model
Scoring model
Model version
v4.2.1
Tokens in
214,800
Tokens out
18,400
Cost
£1.94

WHAT CLIENTS SEE

Live clients work from an operations dashboard built on the same record. These are the views it covers — each one reads from the logged activity above, with approvals and pause controls in the same place.

Overview
Revenue
Pipeline
AI Agents
Leads
Outreach
Conversations
Advertising
Email
Social
Content
Analytics
Automations
Integrations
Approvals
Security
Settings

WHERE THIS STOPS

The activity on this page is an illustrative demonstration, not a client's real record. Customer names are fictional.
A log proves what an agent did. It does not prove the agent was right — that is what review and approval are for.
Decision summaries are written for people to read. Raw model chain-of-thought is not captured, stored or shown: you get the decision and the evidence behind it.
Cost figures cover model usage for the action. They do not include your subscription or the connected platforms' own charges.
Confidence is the model's own estimate. It is useful for routing decisions to people, not a guarantee of accuracy.

The controls that decide what an agent may do unattended are set out in the Responsible AI Centre.

Compliance & Security

SECURITY QUESTIONS, ANSWERED

Everything procurement and compliance teams ask — including how we approach regulated industries.

Is Xiilio GDPR compliant?: Xiilio operates under the UK GDPR, the Data Protection Act 2018 and PECR, is registered with the ICO as a data controller, maintains records of processing activity and lawful-basis documentation for B2B outreach, and signs a data processing agreement with every client. GDPR is a legal obligation we meet, not a certification we hold.
How is client data encrypted?: Data is encrypted in transit with TLS 1.2 or higher and at rest with AES-256 disk encryption on the managed database, object storage and backups. We do not claim application-layer or end-to-end encryption: authorised Xiilio staff with production access can read stored records.
What is voice-print analytics?: During AI voice conversations Xiilio derives sentiment and intent signals from the transcript to score leads. Speech-to-text and text-to-speech are provided by Deepgram and ElevenLabs through Vapi; the models are third-party, not proprietary to Xiilio.
How reliable is Xiilio's platform?: Xiilio runs on managed cloud platforms with daily backups and point-in-time recovery. We do not offer an uptime SLA or publish an availability percentage, and there is no multi-region failover or 24/7 staffed on-call rota. Working recovery targets are 24 hours RTO and 24 hours RPO.
Where is Xiilio's infrastructure hosted?: The production database and file storage run in a single cloud region, confirmed in writing during procurement. Model and voice providers may process requests in the United States under the UK IDTA or EU standard contractual clauses, so we cannot offer a UK/EEA-only processing guarantee.
How does Xiilio monitor for threats?: Application error reporting plus database and function logs, with alerting on failures and authentication anomalies. That is logging and alerting rather than a managed threat-detection service, and there is no 24/7 staffed on-call rota. Vulnerabilities can be reported via /.well-known/security.txt and are acknowledged within one business day.
How do you handle outreach for regulated industries like law firms and insurers?: Litigation, life insurance, and merchant services all carry real regulatory sensitivity — client confidentiality, FCA-adjacent conduct rules, GDPR and PECR compliance in outreach. We build campaigns with that context from day one: message approval workflows, opt-out handling, and audit trails on every send. We're not a compliance provider and don't replace your own legal/compliance sign-off — we build the infrastructure to make that sign-off straightforward.

NEED OUR SECURITY DECK?

Procurement teams welcome. View the full Xiilio security overview deck, or get on a call with our team.

View Security Deck See Xiilio in Action