Security is the foundation, not a feature.

xAct.ai runs fully serverless on Amazon Web Services in a single region — US West (Oregon), us-west-2. There are no long-lived servers to patch, and customer data never leaves the region. The entire stack is defined as code with the AWS CDK and deployed through reviewed, repeatable templates, so every resource, permission, and encryption setting is version-controlled and auditable.

In transit

Every connection is encrypted with TLS 1.2 or higher — TLS 1.3 wherever the client supports it — from the browser to the CloudFront edge and on through the API to the application. Plain-text HTTP is never accepted, and S3 enforces SSL on every request.

At rest

All data at rest is encrypted with AES-256. Every database table — projects, dialogue, users, invitations, institutional knowledge — is encrypted with a customer-managed AWS KMS key with automatic rotation. Document artifacts in S3 use server-side encryption. Runtime secrets live in AWS Secrets Manager, never in source code.

Accounts are managed by Amazon Cognito, with passwordless passkey sign-in as the default: a WebAuthn credential unlocked by Touch ID, Windows Hello, or Face ID — phishing-resistant, hardware-backed, and biometric data that never leaves the device. A password with time-based one-time-password (TOTP) multi-factor authentication remains available as a fallback, under a 12-character minimum policy. Sessions are short-lived, cryptographically signed JSON Web Tokens, verified on every request.

Authorization is least-privilege at every layer. Each serverless function holds only the IAM permissions it needs and nothing more. Within a project, a single-holder baton guarantees that exactly one named person can change state at a time, and every collaborator's access is explicit. Administrative endpoints sit behind a separate allow-list.

xAct.ai is engineered on a SOC 2 control foundation. Its architecture maps directly onto the five Trust Services Criteria an auditor evaluates:

• Security — encryption everywhere, least-privilege IAM, and multi-factor authentication.
• Availability — serverless auto-scaling, multi-AZ managed services, and point-in-time recovery.
• Confidentiality — KMS encryption, scoped access, and secrets isolated in AWS Secrets Manager.
• Processing integrity — an immutable, fully attributed record of every decision (see Auditability below).
• Privacy — data minimization and explicit, per-project access control over personal data.

For current compliance documentation and attestation status, contact us at info@xact.ai.

xAct.ai collects only what it needs to do its job: an account profile (email, display name, organization, optional avatar) and the dialogue content stakeholders choose to enter. Personal data is encrypted with KMS, reachable only by the functions that require it, and isolated per project — a collaborator can see a project only when they have been explicitly added to it.

GitHub credentials, used to create your repository on your own account, are stored encrypted and can be revoked at any time. A project owner can archive or delete a project; deletion removes it from every surface in the product.

Each dialogue round, document upload, baton pass, course-correction, and approval is timestamped and attributed to the individual who performed it. The dialogue is itself a complete, replayable audit trail of how a decision was reached. Platform events stream to an Amazon EventBridge archive with 90-day retention, operational logs are captured in Amazon CloudWatch, and any project's full dialogue can be exported as a Markdown audit file.

When a compliance reviewer or an incident analyst asks who decided this, and when? — the answer is in the record, not in someone's memory.

xAct.ai's AI agents run on Amazon Bedrock. Amazon Bedrock does not use your prompts or the model's responses to train any foundation model, and does not share them with model providers — your dialogue stays your data. Model usage is rate-limited per user as an abuse control.

xAct.ai depends on a small set of service providers. Each one has a specific purpose, and most are optional:

• Amazon Web Services — All compute, storage, database, AI inference (Amazon Bedrock), email, and identity. The platform runs entirely within AWS.
• GitHub — Only when you choose to create a repository. xAct.ai acts through a token you authorize, on your own GitHub account — no shared service account.
• Slack and Microsoft Teams — Optional. If you connect a channel, baton notifications are delivered there. Connect nothing and no data is shared.

Managed AWS services provide multi-AZ availability and automatic scaling. DynamoDB point-in-time recovery and S3 versioning protect against data loss. CloudWatch alarms watch error rates and AI throttling and page the operations team through SNS the moment something is wrong.

The security discipline xAct.ai applies to itself is the discipline it builds into every product specified on the platform. A dedicated Security stakeholder role — with variants for SOC 2, HIPAA, GDPR, PCI-DSS, and FedRAMP — walks every project through threat modeling, authentication and authorization, data protection, secrets management, compliance frameworks, and audit logging.

The PRD xAct.ai produces carries a complete Security & Compliance section, and the generated task list and seeded repository carry those constraints into Construction. The product you build with xAct.ai starts from a security-complete contract — not a security afterthought.

For a security review, compliance documentation, or a pilot, email info@xact.ai. Partnerships, demos, and security questions all land there.