Security and backups
Who can do what, what is recorded, and how it is recovered.
Security is a set of specific habits, not a badge. These are the ones in XTutio, our own product, and the foundation we start client builds from.
Sign-in and access
In useTwo-step sign-in
An authenticator app (TOTP) is required for admins, finance staff and operators. The database itself checks it on money and family tables, not only the app.
Sign-in limits
Repeated wrong passwords slow down and then stop, and a burst of failed sign-ins raises an alert.
Staff sign-in switch-off
A staff member's sign-in can be switched off, and that action is recorded first.
Private realtime channels
Live updates use private channels, so one customer's updates are not delivered to another.
Audit log and alerts
In useWritten before the action
Sensitive actions go into an append-only audit log before they happen, and stop if the record cannot be written.
Security alerts
Sign-in bursts and risky actions raise alerts to the people who need to know.
Exports are recorded
Data exports are logged, so who took what, and when, can be shown.
Payments and the money ledger
In useA ledger that is never edited
The family money ledger is append-only. A correction is a reversing entry, so the history stays intact.
Regulated payment providers
Payments go through regulated providers (Stripe and Airwallex). No card numbers are stored in the app.
Backups and recovery
In useNightly encrypted backups since October 2026: the database and a mirror of stored files are written to an S3 bucket in the customer's own AWS account in Sydney and held under Object Lock for 90 days, so the backup job cannot delete or overwrite a copy. A monthly restore drill restores a copy and checks it against a manifest, and the latest drill passed in October 2026.
Nightly
An encrypted (age) database dump and a storage mirror.
90 days
Each copy is held under Object Lock for 90 days.
Monthly
A restore drill checks a restored copy against a manifest. The latest passed in October 2026.
Separately, a script checks that a rollback to a previous deployment will work before any new release is promoted.
What we do not claim
We do not claim ISO 27001 or SOC 2 certification, because we do not hold either. We do not use words like "military-grade", and we do not promise that a system can never fail or be breached. We describe what is built, whether it is on, and what it does not cover.
These are the practices behind XTutio, our own product, and the foundation we start client builds from. What applies to a particular build is agreed in its scope, and we say so in writing.
Found a problem with something we built? Email team@xlev.ai with what you found and how to see it. Please do not test against real customers' data.