Xandite is built for exactly this: holding a service business's internal documents — price books, vendor lists, standard operating procedures — so the owner and staff can ask questions against them. Each business gets its own workspace. Uploaded files are stored under that business's identity, and every database query is filtered by that identity through row-level security rules, so one business's documents cannot be read from another's workspace. In production, the model that writes answers runs on infrastructure Xandite operates, not a public AI service, so the contents of your documents are not sent to an outside AI provider or used to train anyone's model. Every question and every document change is written to an append-only audit log the owner can review. Xandite does not hold a formal third-party security certification such as SOC 2 today; what is described here is enforced in the system's code and database rules, and an owner can review document handling from the admin dashboard.
No. Xandite does not train AI models on your documents or on the questions your team asks. In production the system answers using a model that runs on infrastructure Xandite operates, and your content is used for one purpose only: retrieving relevant passages from your own library to answer your own team's questions. It is not pooled with other customers' data, and it is not sent to a public AI provider that might use it as training material. In a separate prototype mode, Xandite can call a public model provider, but that path is restricted to synthetic, made-up test data — real business documents are blocked from reaching it by a check in the code that fails closed, meaning a workspace is treated as holding real data unless it has been explicitly marked test-only. The switch to the private production model happens before any real client document is loaded.
No. Xandite is multi-tenant, meaning several businesses are served from the same software, but each one's data is isolated. Isolation is enforced at two layers. First, every request carries the signed-in user's business identity, taken from their authenticated session, and the application checks it before running any database query. Second, the database applies row-level security policies that filter every client table by that same identity, so a query can only ever return rows belonging to the business that made it. This is covered by an automated cross-tenant isolation test that runs on every code change touching authentication, database queries, or those policies. The practical effect is that another company using Xandite cannot search, open, or retrieve your documents, your conversations, your customer records, or your audit history.
No. Xandite does not currently hold SOC 2, ISO 27001, HIPAA, or any comparable third-party security certification, and this page does not claim otherwise. Xandite is an early-stage product run by a small team, and a formal external audit of that kind has not been completed. What Xandite does have is a set of privacy and isolation controls built into the product itself: per-business workspaces, row-level database isolation keyed to each business and checked on every request, a code-level block that keeps real client documents away from public AI services in production, an append-only audit log, and an automated test that checks tenant isolation on every relevant change. These are described in plain terms on this page and in the accompanying privacy guide, so a prospective client can evaluate them directly. If a formal external audit becomes necessary for a specific engagement, that is a conversation to have directly.