Docs·More

Privacy and security

Your documents and questions are processed in memory and never stored or logged. Here is everything we do store, and why.

Never stored #

• Documents you send to /v1/answers and /v1/extract.
• Questions and field definitions.
• Answers.
• Files you send to /v1/convert, and the text we extract from them.

They are processed in memory and never stored or logged. This holds for the API and for the playground alike.

What we store #

Your account. When you sign in, hub.xerj.org tells us who you are. We keep:

• the provider (GitHub or Hugging Face) and your user id and login there;
• your display name and the address of your avatar image;
• whether you added repositories on hub.xerj.org (the hub contributor badge);
• when your account was created.

Your access request. See waitlist below.

Your sessions. A signed session id in the xp_session cookie, valid for 30 days or until you sign out.

Your API keys. For each key: its name, a hash of the key, its prefix (the first 9 and the last 4 characters, such as xerj_8hT2…a1Qx), and when it was created, last used and revoked. We never store the key itself, so we cannot show it again.

Usage records. One per request, with counts and labels only: the time, the endpoint, the model, the key, the status, the input and output token counts, the latency and the list-price cost. A usage record never holds text from a document, a question or an answer. You see these records, added up, on your Usage page and in GET /v1/usage.

Waitlist #

Access is by invitation during the preview. When you request access, we store:

• your company, your work email and your role or job title;
• your answer to “What will you build?”, if you give one;
• when you asked, and when your access was approved and activated.

We use them only to review your request and to send the invitation.

One email. When your access is approved, we send one email to your work address: the invitation, with your activation link. It is from XERJ Platform, with the subject “Your XERJ Platform access is approved”. We send no other email.

The activation link works for 14 days, and only for the account that requested access. We store only a hash of its token.

API keys #

• A key is shown once, when you create it. We store only a hash.
• Keys look like xerj_ followed by 43 characters.
• Revoking a key on the API keys page takes effect at once: requests with it get 401 revoked_api_key.
• Keep keys on your server. Never put a key in browser code, a mobile app or a public repository. The JavaScript SDK refuses to run in a browser with a key unless you set dangerouslyAllowBrowser: true.

Sign-in #

• You sign in through hub.xerj.org, with GitHub or Hugging Face. We never see your GitHub or Hugging Face password.
• The hub sends us a signed, short-lived code. We check its signature, its audience, its expiry and that it was not used before.
• The xp_session cookie is HttpOnly, Secure and SameSite=Lax.

The website #

• Changes need three checks. Creating or revoking a key, signing out and playground requests need the session cookie, a same-origin Origin header and a CSRF token.
• Our code only. Scripts, styles and fonts are served from our own origin, with a Content Security Policy that blocks inline scripts. The only images from elsewhere are avatars from GitHub or Hugging Face.
• No tracking. The site loads no third-party scripts. Its only cookies are for sign-in. It remembers your preferred code language in your browser's local storage.

What we do not claim #

During the preview there is no uptime SLA and no compliance certification. If you need one of these before you send real documents, wait for it, or send only documents you are allowed to share with a third-party service.