SECURITY & COMPLIANCE

Built for sensitive scientific work.

XYNX is designed for biotech teams working with confidential research materials. We combine secure cloud infrastructure, controlled access, traceable AI and human oversight to keep scientific work protected and accountable.

US-hosted infrastructureEncrypted dataControlled AI processingHuman oversight

01 / DATA SECURITY

Protect the work at every layer.

AWS infrastructure in the United States

The default infrastructure plan uses AWS in the United States. Confirm the environment, storage region and subprocessors before using confidential materials.

Encryption in transit and at rest

The security design includes encryption in transit and at rest, with implemented controls and scope verified before customer use.

Organization, Data Room and user controls

Access is scoped by organization, Data Room, user and current authorization. Past access does not grant permanent access.

Bounded external collaboration

CROs, advisers and other collaborators access explicitly shared materials. Internal discussions are not automatically exposed.

Auditability and version history

Exact versions, user attribution and activity records are designed to support traceability across materials, issues and decisions.

02 / AI GOVERNANCE

Controlled AI.
Accountable judgment.

No shared-model training

Customer documents are not used to train a shared foundation model.

Eligible Zero Data Retention

Eligible AI processing uses Zero Data Retention where supported and configured. Provider and endpoint terms define its scope.

Minimum necessary context

AI processing follows minimum-necessary-context principles and uses only currently authorized materials.

Traceable to the evidence

AI outputs are designed to remain traceable to source, version and passage.

People make the final decision

AI can flag, compare, explain and draft; final scientific and regulatory decisions remain with people.

03 / SOURCE INTEGRITY

AI works around the source. It does not silently rewrite it.

01
Source
Original file and exact version
02
AI suggestion / working copy
Proposals stay separate
03
Human review
Check against the evidence
04
Accept / Reject
An explicit human decision

04 / SECURITY & GOVERNANCE FRAMEWORKS

Guided by recognized frameworks.

SOC 2

SOC 2 Trust Services Criteria inform the way XYNX is building its security controls, policies and evidence program. XYNX is building toward independent SOC 2 Type II attestation.

ISO/IEC 27001

XYNX security practices are being developed with ISO/IEC 27001 information-security principles in mind.

ISO/IEC 42001

XYNX AI governance is informed by ISO/IEC 42001 principles around AI risk management, data governance, human oversight and lifecycle control.

05 / REGULATED LIFE-SCIENCE WORKFLOWS

Designed with regulated workflows in mind.

Traceability, version history, user attribution, source integrity, record integrity and human review guide the design.

21 CFR Part 11

21 CFR Part 11 requirements are considered where XYNX is intended to support regulated electronic records and approval workflows. The level of Part 11 control and validation required depends on the intended use of XYNX within the customer’s regulated process.

GxP

GxP use depends on a defined intended use, appropriate validation, configuration and customer quality procedures.

Using XYNX as an assistive review or drafting environment is different from using XYNX as the authoritative system of record for regulated electronic records or signatures.

Start with your intended use.

Define the applicable security controls, contractual scope and validation requirements around your intended use. Explore our FAQs for more on file handling, AI governance and regulated workflows.

Read security and governance FAQs