Data residency
Your data, your hardware.
The master database is Postgres on a laptop or server inside the restaurant, hotel or hospital. The cloud is a write-buffer and backup, never the source of truth. Leaving us is a download — not a negotiation.
Trust at XENIOS
Security,
by design.
XENIOS is an operating system that runs the floor of cafés, hotels and hospitals — when it's down or compromised, business stops and people get hurt. The security posture below isn't a slide deck. It's the model that keeps the lights on at four outlets of Cafe Deja Vu every night since 2017.
Four pillars
The model in four lines.
Local data, encrypted transport, isolated tenants, narrow access. Everything else flows from these.
Encryption
Encrypted in flight and at rest.
All client ↔ server traffic runs over TLS 1.2+. Cloud backups are encrypted at rest. Sensitive tokens (auth, payment intent, smart-lock credentials) are hashed or held in OS keychains — never in plaintext stores.
Tenant isolation
Row-level isolated by design.
On the multi-tenant SaaS side (Hotels, Care), every tenant lives behind row-level security policies at the database layer. One outlet can never see another's reservations, folios, or guest records — by Postgres rule, not by application convention.
Access control
Six roles. Six narrow keys.
Cashier, kitchen, waiter, admin, owner, super-admin — each role sees only the screens and APIs they need. Session tokens rotate. Sensitive actions (refunds, void, discount > limit) require a second auth step from a manager device.
What we do today
The day-to-day practices.
Daily encrypted cloud backups
Snapshots write to your own cloud account when you bring one; otherwise to our managed Cloudflare R2 + Vercel Postgres backup tier. Restore-tested monthly.
Offline-first by default
The in-venue master keeps running even when the internet doesn't. There is no cloud dependency for ordering, billing or kitchen routing — outages don't stop service or leak data over a recovering link.
Hardened network surface
Customer traffic terminates at Vercel's edge (DDoS-shielded). Operational traffic (POS, kitchen, admin) goes to a dedicated subdomain on a hardened VPS. Marketing and operations are physically different machines — a marketing-site bug can't reach your data.
Minimal, transparent tracking
The marketing site loads a Google Tag Manager container so we can measure aggregate engagement — no session replay, no fingerprinting, no ad retargeting. Every operational surface (SROS, Hotels, Care) is tracker-free by policy. Lead capture stays on our own Worker.
Audit-ready trails
Every POS action — order placed, item voided, payment recorded, shift opened/closed — writes an immutable journal row. Tied to user, device and timestamp. Exportable as CSV / SQL for your auditor or franchise HQ.
Production for years
XENIOS has been running 4 outlets at Cafe Deja Vu since 2017 — through power cuts, ISP outages and 100,000+ transactions. The security model isn't a checklist on a slide. It runs every dinner service.
Compliance posture
Honest about
where we are.
We'd rather underclaim and overdeliver than ship a logo wall. Here's the state of play — what we hold today, and what's on the roadmap.
Indian DPDPA — 2023
Built around the Digital Personal Data Protection Act's principles: lawful basis, purpose limitation, minimisation, deletion on request. Data fiduciary duties are documented in our Privacy Policy.
GDPR-aligned principles
Data subject access, rectification and deletion endpoints exist even though most of our customers operate inside India. Cross-border transfer is opt-in.
Working towards SOC 2 Type I
Tracking 5 trust-service criteria (security, availability, processing integrity, confidentiality, privacy). Target audit window: 2026 H2. We'll publish progress here, not after-the-fact press releases.
Responsible disclosure
Found something?
Tell us first.
We'd much rather hear from you than read about it on Twitter. If you spot a vulnerability in XENIOS — the marketing site, the SROS app, the Hotels SaaS, or the Care platform — here's the process.
01
Find something?
Email security@xenios.in with a description, reproduction steps and the impact you observed. PGP available on request.
02
We acknowledge within 24 h.
You hear back from a human on the founding team — not a ticketing bot — within one working day.
03
Triage + fix.
We confirm severity, scope and patch path. Critical issues get a hotfix within 72 hours and a deploy-out follow-up.
04
Credit, if you want it.
With your permission, we'll add you to the Hall of Trust on this page when the fix ships. We don't run a paid bug bounty yet, but we do run a clean disclosure process.
Out of scope
Social engineering of staff, physical access to venues, DoS, reports based purely on outdated CVEs without an exploit path, and anything against third-party services we use (please go to them directly). Everything else: send it our way.
Want a deeper look?
Enterprises, hospitals and franchise HQs can request our architecture and security overview — sub-processor list, data-flow diagrams, backup & restore SLAs, and the responsible disclosure log.