Compliance software has to be trustworthy itself. Here is how XDQ xAgents handle access, data and decisions.
Human in control
Agents draft and check. They do not publish, send, file or pay anything.
Every finding and document needs a person's decision, recorded with name and time.
Owners and admins approve documents; members can review and comment.
Access and sessions
Passwords are hashed with bcrypt and never stored in readable form.
Sessions use secure, http-only cookies and expire after 14 days.
Sign in attempts are rate limited.
Each company's data is separated by workspace; queries are scoped to your company on every request.
What we read
Privacy Scan reads only your public pages, like a normal visitor's browser, after you confirm you own or are authorised to check the site.
It does not test for vulnerabilities, try to log in or crawl beyond a few public pages.
Requests to private and internal network addresses are blocked.
Your data
Data you add stays in your workspace and is used only to run your agents.
We do not sell your data, and we do not train our own AI models on it.
Some agents send the text they need to an outside AI service to write a reply. Free AI services may use what they receive to improve their products, so each workspace chooses in Settings: Standard, Private AI (paid business AI services only) or AI writing off. The list of AI services in use is available from enquiry@xdqlabs.com.
You can export your documents at any time, and ask us to delete your workspace by writing to enquiry@xdqlabs.com.
Records and audit
Every action is written to an audit log visible to your owners and admins.
Reports and documents keep version history so you can show what changed and when.
Responsible disclosure
If you find a security issue, email enquiry@xdqlabs.com with the subject Security. We will acknowledge it and keep you updated until it is fixed.
XDQ xAgents provides tools and drafts to support your compliance work. It is not a law firm and does not give legal or investment advice.