Security

Last updated 24 July 2026 · Yoga on C LLC DBA Xyzios

You are being asked to connect the system that runs your business to software you did not write. That deserves a straight answer about how it is held. This page is what we actually do — and, at the end, what we have not done yet, because a security page that only lists strengths is not worth reading.

Your data is isolated from every other customer

Isolation is enforced in the database itself, not in application code. Every record carries a customer identifier, and row-level security policies mean a query made with one customer's credentials cannot return another customer's rows — even if the application above it had a bug. We test this directly rather than assuming it, including by simulating a signed-in user and confirming what they can and cannot read.

Credentials

The key you give us for your booking platform is encrypted the moment it is submitted and is never stored in readable form, never emailed, and never written into our source code. During onboarding the handoff is single-use: the credential self-destructs once collected, or after 48 hours, whichever comes first.

You keep the power to revoke it. We ask for read-only access wherever the platform supports it.

Our own repository is scanned for secrets before every change is committed, so a credential cannot reach our source history by accident.

Who can see what

Access inside your account is scoped by role. An owner sees everything. A general manager sees only the locations they run — their boards, their members, their reports — and financial and strategic areas are withheld entirely. Front-desk staff see only the day's desk. These limits are applied on the server before data is sent to the browser, so a hidden section is genuinely absent rather than merely not displayed.

Sign-in

Sign-in is by passkey or a one-time link sent to a work email — there is no password to guess, reuse, or leak. Accounts are created by your owner or admin; the service is not open to public sign-up.

An audit trail you can read

Actions that matter — approving a message, changing a setting, adding or removing a staff account, editing your knowledge base — are recorded with who did it and when, and the log is append-only. It is visible to you inside the app, not just to us. Automated agents are recorded distinctly from people, so you can always tell which was which.

Nothing reaches a member without a human

This is a security property, not just a product one. Every member-facing message an agent drafts waits in an approvals queue for a person at your business. There is no configuration that lets an agent message your members on its own.

Infrastructure

Xyzios runs on managed cloud infrastructure in the United States. Data is encrypted in transit, and at rest by our database and storage providers. Application secrets live in managed secret storage, never in code. Nightly data syncs record every run, and failures raise an alert rather than passing silently.

What we have not done yet

Xyzios is early-stage software built for a small number of businesses we know by name. In that spirit:

• We do not hold SOC 2, ISO 27001, or any other third-party certification, and we will not imply otherwise. If you need one to sign, we are not ready for you yet.
• We have not commissioned an external penetration test.
• We do not yet offer a contractual uptime guarantee.

These are on the path as the customer base grows. We would rather tell you where the line is than have you discover it during procurement.

Found something?

Write to [email protected]. We will acknowledge within two business days. We will not pursue anyone who reports a genuine issue to us in good faith and gives us a reasonable chance to fix it.