Security

Security is part of how Xylem Strategic, LLC builds Xylem: authenticated access, workspace isolation, encrypted transport, and server-side handling of secrets. We describe controls that exist in the product foundation. We do not claim certifications or monitoring programs we have not completed.

• Encrypted transport. The application is intended to run over HTTPS in deployed environments.
• Authentication. User authentication is provided through Supabase Auth with session cookies managed via server-side session refresh.
• Workspace isolation. Application data is scoped to workspaces. Database Row Level Security (RLS) policies restrict access to members of the relevant workspace.
• Least-privilege application access. Browser clients use public anon/publishable keys only. Service-role keys, when used, remain server-only and are never shipped to the browser.
• Secrets in environment variables. API credentials and provider secrets are loaded from environment configuration, not hardcoded in the repository.
• Managed infrastructure encryption. Data stored in Supabase relies on the encryption-at-rest and platform controls provided by that managed service and its underlying cloud provider.
• Dependency review. The project uses standard package management. Security updates are applied as part of ordinary maintenance; automated scanning may be expanded over time.

Marketplace OAuth tokens and Selling Partner API refresh tokens (when enabled) are stored and used only on the server. They are not exposed to client-side JavaScript. Disconnecting a marketplace account from Settings marks the connection disconnected and is intended to stop further synchronized use of that authorization.

Manual marketplace account records can also be removed by workspace owners and admins from Brands & Channels.

If you believe you have found a vulnerability in Xylem, please report it responsibly via Support. Include enough detail to reproduce the issue. Please do not access data that is not yours or disrupt the Service while testing.

Privacy and deletion requests use a separate path: Data requests.