Trust & Security
How we protect your account and your data
What is actually in place today, stated plainly. Where something is not yet in place, we say so rather than imply it.
Last updated: 14 October 2026
Encryption in transit
Every page and every API call is served over HTTPS. Plain HTTP requests are redirected to HTTPS, and our web and API responses carry a Strict-Transport-Security header so browsers refuse to connect without encryption.
Your session cookies are marked HttpOnly (page scripts cannot read them), Secure (sent only over HTTPS) and SameSite=Lax.
Encryption at rest
Our database and uploaded files are stored on Google Cloud persistent disks and in Google Cloud Storage, which Google encrypts at rest by default. We do not use our own encryption keys for these stores.
On top of that, the access tokens of services you connect to your account are encrypted by us with AES-256-GCM before they are stored. Passwords are never stored: only a bcrypt hash of each is kept.
End-to-end encrypted messaging
Messages and files you send to other members from the CXO India web and mobile apps are encrypted on your device and can be opened only by the people in that conversation. We store them without being able to read them.
Each message key is protected with a hybrid of X25519 and ML-KEM-768, a post-quantum algorithm, and the content is sealed with ChaCha20-Poly1305. Each member's keys are signed with Ed25519 so a conversation cannot be silently redirected to a different key. If you back up your keys, the backup is locked with your passkey.
Signing in
- A second factor is required to sign in with a password: a code from an authenticator app, with ten single-use backup codes.
- You can add passkeys (WebAuthn) and sign in with your device's biometrics or a security key instead.
- After five wrong passwords, an account is locked for 15 minutes.
- Signing out ends the session on our servers, not only in your browser.
You can review your account's recent activity in Settings.
Where your data is stored
CXO India's servers and database run on Google Cloud in the us-central1 region, in the United States. The platform is not hosted in India. The database is backed up every night to Google Cloud Storage.
AI requests we send to Google are processed by Vertex AI in us-central1, or on Google's global endpoint for the newest Gemini models.
Who processes data for us
These services process data on our behalf, each only for the purpose shown.
| Service | What for |
|---|---|
| Google Cloud | Hosting: the servers, the database disks, file storage, secrets, and the analytics and audit event pipeline. |
| Google Vertex AI (Gemini) | The AI features: matching, CXO Intelligence, drafting and recommendations. |
| Twilio SendGrid | Sending email: sign-in codes, notifications and replies. |
| Razorpay | Taking payments for paid plans and services. |
| Apple Push Notification service and Firebase Cloud Messaging | Delivering push notifications to the iOS and Android apps. |
| Google, LinkedIn and Microsoft | Signing in with those accounts, only if you choose to. |
| Google Analytics, Google Ads and LinkedIn | Website analytics and advertising measurement, loaded through Google Tag Manager. See the Cookie Policy. |
Your data and your rights
- Delete your account. It is deactivated at once and every session is ended.
- To ask for a copy of your data, a correction or erasure, raise it with our Grievance Officer. There is no self-service download yet.
- Control how your profile is seen in Settings.