Security | Scalix World

Last updated: 24 September 2026

Scalix takes security seriously. Here is how we protect your data and infrastructure.

Our Approach

Security is built in, not bolted on: the platform — gateway, IAM, databases, compute — is our own code running on our own dedicated hardware in the EU, so security decisions are ours to make and to prove. Like all cloud platforms, security is shared: Scalix secures and operates the infrastructure, platform, and isolation controls; you control your workloads, data, API keys, and access settings.

Encryption

- TLS 1.2+ for all data in transit (TLS 1.3 on the live API) - AES-256-GCM envelope encryption for secrets, credentials, and private keys - Encrypted off-site backups (nightly, within the EU) - API keys are stored hashed, never in plaintext

Infrastructure

- Deployed on dedicated servers in the EU (Hetzner, ISO 27001-certified data centres) — no hyperscaler, no shared tenancy at the host layer - Dedicated micro-VM isolation (Firecracker) for serverless functions and app runtimes - Per-tenant database isolation: isolated database and role per tenant - Per-workload network isolation between tenants - Self-hosted, cookieless analytics and monitoring — no third-party trackers on our infrastructure

Authentication

- Multi-factor authentication (TOTP) available on every account - API key scoping with granular permissions - JWT session management with configurable TTL

Database Security

- Query firewall to help mitigate SQL injection - Connection pooling with per-tenant isolation - Point-in-time recovery for data protection - Hash-chained, append-only audit log of administrative actions, exportable via API

Compliance

- Designed to meet GDPR (EU/UK) requirements; EU data hosting, with additional regions planned for sovereignty requirements - Designed to meet India DPDP Act requirements; our Grievance Officer is published on the Contact page - SOC 2 Type II: audit engagement planned for Q4 2026. We hold no third-party certification today — when we do, the report will be available here and on request. - Every sub-processor, what it processes, and where, is published at scalix.world/subprocessors

Incident Response & Vulnerability Disclosure

We maintain a security incident response plan, including 6-hour reporting obligations under India's CERT-In directions. Live service status and incident notices are at status.scalix.world.

Found a security issue? Please report it responsibly to security@scalix.world (our disclosure details are published at scalix.world/.well-known/security.txt). We acknowledge reports within 24 hours.