Security and data
This page says what xEvolve keeps for you and where. It is not a certification. xEvolve does not claim SOC 2 or similar attestations.
What is stored
- Files you upload or transfer into your Environment, in Cloudflare R2.
- Connection credentials, encrypted with AES-GCM, and PGP private keys, encrypted at rest.
- Users, roles, connections, schedules, workflows and the activity log, in your own schema of the shared EU Postgres database.
- API keys as a SHA-256 hash only.
Files you move between two of your own connections go to the destination you chose.
Where it is kept
The database is Supabase in Paris. Files are in Cloudflare R2 in Western Europe. Direct signup is EU-only on every plan, so there is no region to choose. Workspaces bought through Azure Marketplace are stored in the Azure region the buyer picks: North Europe, West Europe or a US region. The full list of subprocessors is on spot-suite.com.
Protection
- Files at rest use AES-256. Browser and API traffic uses TLS 1.2 or newer. FTPS uses TLS and SFTP uses SSH.
- Each Environment has its own database schema. Files and audit entries are scoped to your tenant.
- Every upload is checked for dangerous file types and its hash is looked up with VirusTotal. Blocked uploads are logged.
- Webhook and SMTP addresses must be public HTTPS or SMTP hosts, not private networks.
Audit log
Logins, uploads, downloads, shares, data room changes, API key changes and retention runs are recorded with the user, the client IP and a UTC timestamp. Admins read the log in Admin. Audit entries are never deleted automatically.
Retention
Deleted files are soft-deleted first and removed for good after 30 days, unless a legal hold applies. Team and higher plans can set a retention period; admins review and run cleanup from a console session. Legal hold needs Business or MSP.