Trust Center
Our commitment to transparency, security, and responsible practices.
Security Overview
XertyFi is designed with security as a foundational principle. We use industry-standard practices to protect customer data and maintain the integrity of our platform.
Data-Handling Principles
We collect only the minimum information required to perform assessments. Customer data is isolated by organization and never shared between customers.
Assessment Methodology
Our assessments use publicly available information and non-intrusive external checks. We do not perform active exploitation, credential attacks, or destructive testing.
Service Limitations
XertyFi assessments are point-in-time external reviews. They do not guarantee complete security, detect all vulnerabilities, or replace comprehensive penetration testing.
Customer Authorization Requirements
Customers must confirm ownership or explicit authorization before any assessment is performed. We do not assess domains without verified authorization.
Incident-Notification Policy
In the event of a security incident affecting customer data, affected customers will be notified in accordance with applicable laws and our incident response procedures.
Data-Retention Summary
Customer data is retained for the duration of the active subscription plus a configurable grace period. Customers may request data deletion at any time.
Access-Control Summary
Access to customer data is restricted to authorized personnel with a legitimate business need. Role-based access controls enforce organization-level isolation.
Encryption Summary
Data in transit is encrypted using TLS. Data at rest is encrypted using industry-standard algorithms.