Data handling & security

Separation between workspaces and client companies

Each customer's workspace is a separate tenant. Every read and write to the database is filtered to the requesting workspace, and that filter is re-checked on the server on every request — it is never inferred from something the browser sent on its own. Where a single workspace holds more than one client company (as a consultancy's does), each client company's records carry a second, independent check inside the workspace boundary, so one client's data is not visible through another client's screens even though both belong to the same workspace.

A request for another workspace's data, or another client company's data, behaves exactly like a request for something that does not exist. It never confirms that the data exists somewhere else.

Where your data is hosted

Production infrastructure — the application, the database and file storage — runs in the EU (Frankfurt). The database has no public network address at all; it is reachable only from the application itself. There is no direct remote-login access to any server — administrative access goes through our cloud provider's own identity-gated, logged session tooling rather than an open network port.

Encryption

Data at rest is encrypted: the database uses our cloud provider's storage-level encryption, and files stored as attachments use AES-256 server-side encryption with public access blocked at the storage layer. Data in transit is encrypted too — connections between your browser and the app are TLS-protected with HTTPS enforced, and the connection between the application and the database also requires an encrypted channel.

Who inside XpertLab can see your data

By default, access inside the product is scoped to your own workspace: someone who is a member of one workspace cannot see another workspace's data through the product. A small number of internal XpertLab staff — a short, explicitly named list, not our general engineering population — can open a read-only support view across workspaces for troubleshooting. That view does not grant the ability to edit, score, approve or export your plan on your behalf.

Who else receives your data

Running the service involves a small number of outside providers, each limited to what it needs to do its job. We describe them below by category rather than by name.

• An AI model provider — receives the OKR content you or your team enter (objective and key-result text, named owners, chat instructions, and company research summaries) in order to draft, critique and cascade your plan. We have not yet obtained and verified a written commitment from this provider covering whether it retains or trains on this content, and we do not represent that it does not. We will update this page once that commitment has been reviewed and documented.
• A cloud infrastructure provider (EU-hosted) — hosts the application, database and file storage described above.
• An email delivery provider — sends transactional email such as invitations and notifications on our behalf.
• A product analytics provider — receives limited usage data to help us understand how the product is used.
• An error monitoring provider — receives technical error reports, such as stack traces, to help us find and fix bugs. We do not deliberately include personal information in these reports, beyond what may appear incidentally inside a trace.

What we do not claim

We do not currently hold ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 or SOC 2 certification. This page describes the controls we have built. It is not a substitute for your own security review, a signed data processing agreement, or a contract.