Built to be deployed inside your perimeter and audited.
This page states what we do, plainly, including what we do not yet have. Security questionnaires and client audits are welcome; a mutual NDA is available on request.
Deployment you control
Every product can run in your VPC or on-premises. EntropyX Chat and EntropyX PSP are self-hosted by design. Managed cloud, where chosen, runs on dedicated tenants with your data isolated.
Your data stays yours
Client records, messages, wallets and keys live on infrastructure you own. We do not train models on client data, and we do not hold funds.
Encryption
TLS for every connection, including internal service traffic where the deployment allows it. At-rest encryption follows your storage layer and can be enabled per environment.
Access control
Role-based access in every product, two-factor authentication where users log in, optional SSO (SAML/OIDC) for EntropyX Chat, least-privilege service accounts for platform integrations.
Audit logs
Who did what, when and from where, with before and after values, in Brokerage CRM, EA Panel, EntropyX Chat, Tickets, CA_CS Tool and Investor CRM. Logs are exportable for review.
AI safety controls
Agents act only through explicitly permitted tools, run sandbox-then-live, log every step per run, and fall back to a human for anything consequential. Evaluations run before release.
Secure development practice
- Every product ships as versioned releases; changes are reviewed before they reach production and recorded in a changelog.
- Dependencies are updated on a regular cadence and when advisories are published.
- Secrets never live in source control. Production credentials are held in environment files or vaults on the deployment host.
- Production access is limited to named engineers, over SSH with keys, through an audited bastion.
- Backups are taken for managed deployments and can be configured for self-hosted ones during setup.
Certifications and audits
EntropyX Labs does not currently hold ISO 27001 or SOC 2 certification. We complete client security questionnaires, support client-led audits and penetration tests of deployments we run, and will state here when a certification is obtained. We prefer to say this plainly rather than imply otherwise.
Responsible disclosure
If you believe you have found a vulnerability in one of our products or in this website, email sales@entropyxlabs.com with the subject “Security report”. We acknowledge within one business day, keep you informed, and do not pursue good-faith researchers.
This website
entropyxlabs.com is served through Cloudflare (TLS termination, CDN) from servers we operate. The contact form stores enquiries on our own infrastructure and emails them to the team; no third-party form processor is involved. We do not run advertising trackers. See the privacy policy.
Send us your questionnaire.
We return security questionnaires within a few business days, with an engineer available for a call on anything that needs context.