This page describes Xenmark's security posture at a high level. It covers the access controls, infrastructure choices, and practices in place. No system is perfect, and Xenmark does not make claims of full security, formal certification, or specific compliance framework status.
1. Application access
The Xenmark application at my.xenmark.app requires account authentication to access. Unauthenticated users cannot view project data, drawings, comments, or files.
All connections to the application and marketing site are served over HTTPS. Unencrypted HTTP connections are not supported.
2. Project access and roles
Inside the application, access to projects, drawings, comments, and member data is enforced at the database level using project-based roles. Users can only access projects they belong to. Role controls determine what actions each member can take within a project.
There is no shared or public project mode. All project content requires an authenticated session.
3. File storage
Drawing files and attachments uploaded to Xenmark are stored in Cloudflare R2 object storage. File access is gated behind token-based authorization through a Cloudflare Worker, which enforces that the requesting user has valid project access before serving file content. Files are not accessible via direct public URLs.
4. Authentication and secrets
User authentication is handled by Supabase, which manages sessions, password hashing, and token issuance. Secrets management for backend functions uses Supabase Vault. Service-level credentials are not exposed to the frontend.
5. Transactional email
Outbound service emails (account notifications, reminders) are sent through Resend. Email delivery credentials are held server-side only and are not accessible from the browser.
6. What Xenmark does not claim
Xenmark does not currently hold SOC 2, ISO 27001, HIPAA, or any other formal security certification. This page describes current practices, not certified controls. Users who require certified systems for regulated workflows should use purpose-built, certified platforms.
See the Acceptable Use page for a description of workloads Xenmark is not suited for.
7. Reporting a vulnerability
If you believe you have found a security vulnerability in Xenmark, please report it responsibly rather than disclosing it publicly. Contact us at [email protected] with a clear description of the issue. We will acknowledge your report and work to address confirmed vulnerabilities promptly.
Please do not attempt to exploit vulnerabilities or access data that does not belong to you.