Enterprise
For an organisation whose security team asks first
Software that can send to your customers and spend on your ad accounts has to answer to somebody. This is what answers for it — and what is not in place yet, named on the same page.
14-day evaluation · no card · start before you connect anything
What this looks like end to end
Your own systems on the left of each step, the work Xyranik does in the middle, and the outcome it can actually measure at the end.
What changes
How this runs today
The review asks one question and gets several answers
Who may do what is configured separately in each tool. “What did software do last quarter, and on whose authority” is assembled afterwards, by hand, from places that disagree.
Automation runs as a person
Scripts and integrations act on somebody’s credential, so the log records a person doing it. Revoking that one credential breaks things nobody has a list of.
Nothing stops everything
There is no single control that halts automated action, because the automation is spread across a dozen systems that were never meant to be stopped together.
With Xyranik
Single sign-on and provisioning
People sign in through your identity provider over OpenID Connect, and a connection accepts only its own domains. Your directory can add people, change their role and remove access over SCIM 2.0, and removing somebody takes effect at once.
Sign-in restricted to your own addresses
A workspace can limit itself to its own ranges, checked on every page and every API request rather than only at sign-in — so a session that moves to another network stops working rather than carrying on.
An audit log nothing edits
Who did what and when, including the system and every agent. Each closed day is hashed and chained to the day before, so a row changed afterwards no longer matches its seal. The seals sit in the same database as the log, which is stated on the security page rather than glossed over.
No agent acts without being allowed to
Every action software asks for is decided before it happens, against what that agent may do, the data it may use, the risk involved and the rules you wrote. The model asking never decides. One switch stops all of them, and if that switch cannot be read, everything is treated as stopped.
Data controls people can exercise
Export and erasure for a person’s records, retention periods for form contents and anonymous visits, and credentials encrypted before storage under a key that can be replaced without breaking a connection.
What it does not do for you
Listed here rather than discovered in week two.
No certification, and we will not imply one
Xyranik holds no SOC 2 and no ISO 27001, and has had no external audit or penetration test. We do not describe ourselves as aligned with or working toward them, because that is not something you could verify.
One region, and no SAML
There is a single deployment, so you cannot choose where data is kept. Single sign-on is OpenID Connect; SAML is not supported.
Start before you connect anything
The evaluation begins with what Xyranik can read from your own site, so you can judge what it would propose before deciding whether it may do any of it.