What we do with your data.
Plain-language disclosure of every place your data travels when you use Xaish. Updated .
What you paste goes to an AI provider
Most Xaish tools work by sending your input — code, configs, logs, transaction details, threat intel — to a third-party AI provider for analysis. Today that provider is Anthropic. The provider receives your text, returns a structured analysis, and is contractually bound to not use your prompts to train their general models. If you need a different provider contract (BAA for HIPAA, EU residency, etc.), reach out via /contact before subscribing.
We redact credentials before the AI sees them
For the three scanners that explicitly accept pasted source code — Tools #8, #12, and #25 — the backend runs a credential redactor against your input before any network call to the AI provider. The redactor catches Slack tokens, GitHub PATs, OpenAI keys, AWS access keys, signed-JWT secrets, Authorization headers, and similar high-shape strings. The actual secret value never leaves our server. The AI provider sees [REDACTED-CREDENTIAL:<kind>] markers instead, and our response envelope tells you how many redactions happened.
Other tools that don't expect raw source code do not auto-redact — if you paste sensitive material into, say, a payment-routing tool, that material reaches the AI provider as-is. Don't paste production secrets into Xaish.
Payment data — we never see card numbers
All subscription payments and Paynnt fees flow through Stripe. We store only the stripe_customer_id + the subscription status; the actual PAN, CVV, and expiration live in Stripe's PCI-DSS Level 1 environment and are not accessible to Xaish.
Crypto wallets — two custody modes
Paynnt supports two ways to hold value on Solana:
- Server-custody (default). We mint a Solana keypair for your account and store the secret key Fernet-encrypted at rest under
PAYNNT_VAULT_KEY. Only the server-side wallet code can decrypt and sign with it; it never appears in logs, responses, or backups in plaintext. - External wallet (self-custody). Connect Phantom, Solflare, or Backpack and prove control via a signed-challenge handshake. We store only your public key; the private key never touches our infrastructure.
Authentication — what's in the cookie
Your session is a short-lived JWT in an HttpOnly, SameSite=Lax cookie, signed with XAISH_JWT_SECRET. Passwords are stored as bcrypt hashes; we cannot recover them — which is why the reset flow exists. Email verification and password reset tokens are also stored as bcrypt hashes; the plaintext is shown to you once in the email and is otherwise unreachable.
What we log
Every API request emits one JSON access log line containing method, path, status code, latency, client IP, and a per-request UUID. We do not log request bodies in normal operation. Unhandled exceptions log a redacted traceback. Logs persist on the host running the service; retention depends on your deployment.
Each authenticated tool call writes one usage_events row (workspace, tool id, endpoint, status, timestamp) for billing reconciliation and quota enforcement. Free-preview calls by anonymous visitors are counted per-IP in process memory only.
What we keep, and for how long
- Account + workspace data: kept as long as the workspace exists. Delete via /contact.
- Usage events: kept indefinitely for audit + billing reconciliation. We can purge a workspace's rows on request.
- Paynnt transactions: kept as part of the on-chain history. The chain itself is immutable; we keep an off-chain summary for the UI.
- Access logs: retained per your deployment's log aggregator policy. Default in single-VPS Docker is ~14 days.
- One-time tokens (verification, reset): deleted on consumption or after their TTL (24h for verification, 1h for reset).
Your rights
You can request a copy of your data, ask us to correct or delete it, or close your account at any time. Email privacy@xaish.com or reach out via /contact. We respond within 30 days, faster for material misuse claims.
Compliance posture
SOC 2 Type 1 in progress — target attestation Q4 2026. PCI-DSS is delegated to Stripe (we are out-of-scope for PAN handling). The Paynnt non-crypto rail will land an additional PCI-vault tokenization layer when the vendor selection closes (see /paynnt). Reach out for any compliance questionnaire — we send the security-questionnaire pack directly via /contact.
Changes
We'll bump the "Updated" date at the top of this page and post a one-line summary in the platform changelog. Subscriber-tier accounts get an email for any material change.