Security & AI
Careful with your data, by design
How Videxa keeps each business’s data separate and protected, what Business AI may and may not do, and what the public demo does with what you enter.
How data is protected
These safeguards are built into Videxa today.
Every business kept separate
The server ties each request to one business, every query filters on it, and row-level security in PostgreSQL enforces it as a third layer.
Passwords stored safely
Passwords are hashed with PBKDF2-HMAC-SHA256 and 600,000 iterations. The password itself is never stored.
Secure sessions
Signing in sets an httpOnly, Secure cookie with a random token. Only a hash of it is kept, and a session ends after 14 days without use.
Protected requests
Changes are checked against cross-site request forgery, and signing in, the API and AI are rate limited.
Integration tokens sealed
Access tokens from connected tools are encrypted with AES-256-GCM. Connecting uses single-use state, with PKCE where the provider supports it.
Disconnect means gone
Disconnecting revokes the access token where the provider allows it, and deletes the data that came from that connection.
Private documents
Uploads are stored privately, their type is checked from the file itself, and downloading requires permission.
Audit log
Important actions are recorded in an append-only audit log.
Every number traceable
Figures and AI answers keep a link to the source they came from.
No trackers here
This website runs without cookies, analytics or third-party scripts.
What Business AI may and may not do
Every AI action goes through the same rules as the rest of the product. The model doesn’t decide what it’s allowed to do.
One AI model, named openly
Live AI is Claude Haiku 5.5 (Anthropic), running at Google Cloud (Vertex AI) through OpenRouter. Requests only go to Google, never to other providers. The built-in assistant answers without any outside model.
Where AI may run
Live AI may be processed outside the EU. If you don’t want that, choose EU-only or local-only in your policy: the built-in assistant then answers, without an outside model.
What AI may receive
Choose which kinds of data may go to the AI model: financial, customer, document, marketing or website data. Staff data only goes if you allow it. Passwords and access keys never do.
| Read business data | Allowed |
|---|---|
| Create tasks | Approval required |
| Change financial data | Approval required |
| Change integrations | Approval required |
| Pay invoices | Not possible |
Reading still follows the user’s role: Business AI only sees what that person may see.
What the demo does with what you enter
- No account, password or real integrations needed.
- What you enter stays in this browser.
- All business data is simulated and labelled as demo data.
- The demo AI is a deterministic planner, not a language model.
- Resetting the demo deletes your demo workspace from this browser.
Not built yet
Worth knowing before you rely on Videxa. These are planned, but not there today:
- Backups stored away from the server
See what Videxa would flag for a business like yours
Describe a business and the demo builds a simulated version of it to explore.
No account needed