Security at OS iXanagi

Last updated: October 31, 2026

Every request is tied to a signed-in user and a verified tenant membership taken from the session, never from the request body. Requests that name another tenant's data are refused.

Each action declares the permission it needs, and the server checks it on every call, whether the request comes from the console, the API or an AI feature. Hiding a button is never the only control.

AI proposes; people approve. AI acts without approval only within an Agent Mandate a person has granted, with scope and budget limits. Every AI proposal, approval and resulting action is recorded.

Keys and tokens for services you connect are encrypted with AES-256-GCM and are never returned to the browser.

Features that fetch web pages block private network addresses and cloud metadata endpoints.

Sensitive data, such as personal information, carries labels that limit who can read it.

The service runs on AWS in the US West (Oregon) region. Traffic is encrypted with TLS, and the database is encrypted at rest. The database is backed up automatically and backups are kept for 7 days; we restored from backup before going live. Requests are rate limited.

We do not currently hold SOC 2 or ISO 27001 certification.

Email security@cloudeffects.com. Please do not test against other customers' data.