XnoleX is built with a security-first architecture. We apply the same rigor to our own platform that we help you apply to yours.
Asymmetric key-based token signing with RS256 algorithm. Private keys stored with filesystem permissions (chmod 400).
Granular RBAC with Owner, Admin, Manager, Operator, and Viewer roles. Permission-gated endpoints.
AES-256-GCM encryption for stored secrets and API keys. Fernet symmetric encryption for at-rest data.
Immutable audit log recording all API calls with user, action, resource, timestamp, and success/failure status.
Per-user and per-endpoint rate limits with configurable thresholds. Login brute-force protection.
TLS 1.2+ encryption in transit. HTTP security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options).
While XnoleX is not formally certified, our security architecture is aligned with industry standards including OWASP Top 10, SOC 2 Type II controls, and GDPR data protection requirements.
If you discover a security vulnerability in XnoleX, please report it responsibly by contacting our security team at security@xnolex.com. We take all reports seriously and will respond within 48 hours.