Security

How we keep your data safe.

xrecommend is a hosted service: we run the infrastructure, you push records and search them. This page describes how we keep your data safe.

Data isolation

Every account is a row in a shared SQLite database with account_id on every domain row. Every query in the application layer is scoped to Current.account; the vector and FTS5 indexes use account_id as a partition key. There is no path from one tenant to another.

Authentication

• Web — Rails 8 session-based auth with bcrypt-hashed passwords (cost factor 12).
• API — Bearer tokens. The raw token is shown to the user once at creation and never stored; we only keep a SHA-256 digest.
• Encryption at rest — All API keys are stored as SHA-256 digests. Passwords use bcrypt. Database files can be encrypted at the filesystem level (LUKS / EBS encryption).
• Encryption in transit — TLS 1.3 only, via Caddy with automatic Let's Encrypt on hosted deployments.

Reporting a vulnerability

Email [email protected] with a description and reproduction steps. We respond within 24 hours and ship a fix within 7 days for high-severity issues. We do not run a paid bug-bounty program yet.

Compliance

We are SOC 2 Type I in progress (target: Q4 2026). We can sign DPAs on Enterprise plans.