Trust · Security
Security
Xvest runs a formal security program covering SOC 2, ISO 27001, public penetration testing, independent security audits, and a recognized bug bounty.
This page is the public summary of how Xvest protects accounts, sessions, and data. For privacy rights and processing details, see the Privacy Policy.
Security program
- SOC 2. Controls aligned to SOC 2 trust service criteria for security, availability, and confidentiality of the Xvest platform.
- ISO 27001. Information security management practices aligned with ISO/IEC 27001 for people, process, and technology controls.
- Public penetration testing. Regular third-party penetration tests of public surfaces, with findings tracked to remediation.
- Independent security audits. Independent security reviews beyond automated scans, covering application, infrastructure, and access controls.
- Recognized bug bounty. A coordinated vulnerability disclosure program with safe harbor for good-faith research and rewards for valid reports.
Report a vulnerability
Researchers acting in good faith are welcome. Email security@xvest.tech with a clear description, impact, and steps to reproduce. Do not access or modify other users’ data, and do not disrupt the service.
Valid reports through the bug bounty program are acknowledged and tracked to remediation. We ask for a reasonable window before public disclosure.
Frequently asked questions
Does Xvest have a security program?
Yes. Xvest maintains SOC 2 and ISO 27001-aligned controls, public penetration testing, independent security audits, and a recognized bug bounty.
How do I report a security vulnerability?
Email security@xvest.tech with steps to reproduce, impact, and any proof-of-concept. Do not include personal data of other users.
Where can I read Xvest’s security posture?
The official Security page on xvest.tech summarizes certifications, testing, audits, and the bug bounty program.