Security Policy

Effective Date: July 1, 2026
Last Updated: July 1, 2026
Version: en-US 2026-07-01
Contact: [email protected]

This Security Policy summarizes Txaion's security approach for its websites, hosted software, APIs, AI features, voice features, digital twin features, and related services (collectively, the "Services"). This policy is incorporated into the Terms of Service and supports the Data Processing Addendum.

Security is a shared responsibility between Txaion, Customers, users, cloud providers, and subprocessors.

1. Security Program

Txaion maintains a risk-based security program designed to protect the confidentiality, integrity, and availability of the Services and Customer Content. The program is informed by common SaaS security practices and frameworks such as NIST Cybersecurity Framework concepts, adjusted for Txaion's size, architecture, risk profile, and product maturity.

2. Administrative Safeguards

Txaion's administrative safeguards include, as appropriate to the Services, architecture, size, and risk profile:

• Security ownership and internal accountability
• Personnel confidentiality obligations
• Access approval and periodic access review
• Vendor and subprocessor security review
• Security incident response procedures
• Security awareness and secure handling expectations
• Policies for acceptable internal use of systems and data
• Internal procedures for support access to Customer Content where such access is needed for support, safety, debugging, security, or legal compliance

3. Access Controls

Txaion uses access controls designed to limit access to production systems and Customer Content to authorized personnel with a business need. Controls include, where supported and appropriate:

• Least-privilege access
• Role-based access where supported
• Multi-factor authentication or equivalent strong authentication for administrative access where supported
• Logging and review of privileged activity where feasible
• Business-need approvals for personnel access to production systems or Customer Content
• Removal or modification of access when personnel roles change

Customers are responsible for configuring their own accounts, users, permissions, SSO, MFA, API keys, webhooks, and integrations.

4. Encryption

Txaion uses encryption in transit for supported Services using TLS or equivalent technology. Txaion uses encryption at rest where supported by its infrastructure providers and product architecture.

Some Customer Content may be processed in memory, caches, queues, logs, or temporary storage as necessary to provide the Services. Txaion uses controls designed to limit retention and access to such temporary processing locations according to product design, operational needs, and applicable law. Customers should avoid submitting unsupported sensitive data.

5. Application and Infrastructure Security

Txaion's application and infrastructure safeguards include, as appropriate to the Services, architecture, size, and risk profile:

• Secure development practices
• Dependency and vulnerability management based on severity and exploitability
• Environment separation where commercially reasonable
• Input validation and abuse controls
• Rate limiting and anti-abuse measures
• Backup and recovery processes
• Logging, monitoring, and alerting
• CDN, DNS, WAF, DDoS mitigation, or similar protections through infrastructure providers

6. AI and Voice Security

For AI, voice, and digital twin features, Txaion uses additional safeguards as appropriate to the feature, risk profile, and product configuration, such as:

• Abuse detection and policy enforcement
• Prompt, input, output, file, audio, and metadata review where needed for safety or security
• Consent and authorization requirements for voice or likeness features
• Restrictions on high-risk use cases
• Logging of model requests for security, support, debugging, and compliance where appropriate
• Controls designed to prevent Customer Content from being used for third-party foundation model training or Txaion general-purpose model training unless authorized as described in the Privacy Policy, DPA, and AI Policy

7. Incident Response

Txaion maintains procedures to identify, investigate, contain, mitigate, and remediate security incidents. If Txaion becomes aware of a personal data breach affecting Customer Personal Data, Txaion will notify affected business Customers as described in the DPA. If Txaion is legally required to notify individuals, regulators, or authorities, Txaion will do so according to applicable law. Incident notices may be updated as additional information becomes available and are not admissions of fault or liability.

8. Data Retention and Deletion

Customer Content retention depends on product settings, account status, subscription terms, backups, legal requirements, and security needs. Deleted data may remain in backups or logs for a limited time before being overwritten according to retention practices, unless legal holds, disputes, security investigations, or compliance obligations require longer retention.

Voice, likeness, biometric-related, and digital twin materials may be subject to additional retention, consent withdrawal, and deletion requirements depending on the feature, jurisdiction, and Customer instructions.

9. Business Continuity and Backups

Txaion uses commercially reasonable backup and recovery practices appropriate to the Services. Unless a separate written SLA states otherwise, Txaion does not guarantee uninterrupted service, recovery point objectives, recovery time objectives, or restoration of all Customer Content.

10. Customer Responsibilities

Customers must:

• Use strong passwords and MFA where available
• Protect API keys, OAuth tokens, credentials, and recovery codes
• Configure user roles, permissions, integrations, and sharing settings carefully
• Keep endpoints, browsers, systems, and dependencies updated
• Use secure network and device practices
• Avoid uploading unsupported sensitive data
• Maintain independent backups of critical content
• Promptly report suspected security issues
• Ensure end users and administrators comply with the Terms, AUP, AI Policy, and applicable law

11. Vulnerability Disclosure

Txaion welcomes good-faith vulnerability reports. To report a vulnerability, email [email protected] with:

• A description of the issue
• Affected URL, endpoint, account, or feature
• Reproduction steps
• Potential impact
• Screenshots, logs, or proof of concept if safe to provide

Good-faith research must avoid privacy violations, data destruction, service disruption, social engineering, phishing, extortion, spam, persistence, lateral movement, or access to data that is not yours. Do not publicly disclose a vulnerability until Txaion has had a reasonable opportunity to investigate and remediate.

Txaion does not currently promise a bug bounty or compensation unless expressly agreed in writing.

12. No Absolute Security

No service can guarantee perfect security. Unless stated in a signed agreement, Txaion does not represent that the Services are certified under SOC 2, ISO 27001, PCI DSS, HIPAA, FedRAMP, or similar frameworks. This Security Policy describes current practices and does not create warranties, service level commitments, or independent liability beyond the Terms or applicable written agreement.