Security
Security at ProjectX.
How ProjectX is built to be secure, where to read the detail, and how to report a vulnerability. The short version is here; the trust page is the long one.
Security
The posture, in short
- Authorisation is deny-by-default and fails closed: one component decides every access, and if it is unavailable the answer is no — never yes. There is no superuser flag and no wildcard service account, including for us.
- Every action is written to a tamper-evident, hash-chained audit log — the refusals as well as the successes — and no route can opt out of it.
- Data is encrypted at rest and in transit, placed in the region you choose, and kept there in software rather than by policy. Access to your data by our staff is break-glass, approved and audited.
Security
The detail
The claims above, each with the mechanism that enforces it, and where every compliance target actually stands.
- Trust and securityThe thirteen invariants, the compliance frameworks and where each stands, and the responsible-use boundaries.
- Service level agreementThe availability targets and the service-credit model.
- SubprocessorsThe providers and regions your data may be placed with.
- Data processing addendumHow we process personal data as your processor.
Security
Report a vulnerability
If you have found a security issue, tell us before you tell anyone else and we will work it with you. We do not pursue good-faith research that stays within the bounds below, and we would rather hear about a flaw from you than from an incident.
- Report privately to the security contact below, and give us a reasonable window to fix it before any disclosure.
- Do not access, change or delete data that is not yours, and do not degrade the service for others — no denial-of-service, no spam, no social engineering of our people.
- Stay within your own account and test data. A proof of concept against your own tenant is worth more to us than one against someone else’s.
A security contact address is not configured for this site. The contact page carries the general channel, which reaches us too — mark it security and it will be routed.
security.txt
Machine-readable disclosure details are published at /.well-known/security.txt, per RFC 9116.