The questions you should be asking us.

Engaging a security provider means extending your attack surface to include them. That is a real risk and it deserves a direct answer, so here are the questions we would ask in your position — answered before you have to ask.

• Access to our systems

  Least privilege, time-bound, logged. Engineers hold read access to processed telemetry. Any elevated action requires approval, expires automatically, and is recorded in an audit trail you can request at any time.

• If Xoopie is breached

  Your immutable copies survive it. Object Lock in compliance mode means a compromise of our environment cannot delete or alter your archived data. We notify affected clients within 24 hours of confirming an incident, before any public statement.

• Who can see your data

  A named, minimal team. Access is scoped to the engineers on your account. We do not use client data for training, benchmarking or product development, and we do not sell or share it.

• Sub-processors

  Listed, and you are told before they change. Our infrastructure providers are disclosed in the agreement, with advance notice of any addition so you can raise an objection.

• Our own staff

  Background-checked, on hardware we manage. Company devices with full-disk encryption and endpoint detection, phishing-resistant multi-factor authentication, and no client data on personal machines.

• If we fail you

  It appears in your own report. Missed standards carry service credits applied automatically, without you needing to raise a claim, and the miss is recorded in the monthly evidence document rather than quietly omitted.

• If you leave

  Data and documentation handed over. A clean export in open formats plus transition assistance, written into the agreement rather than negotiated under pressure at the end of a term.

• Vulnerabilities in our platform

  Reportable, and rewarded. We publish a responsible disclosure policy at the standard location, respond within two business days, and will not pursue researchers acting in good faith.

01 Where your data goes

A reasonable question that most providers answer vaguely. Agents only ever connect outbound, so we never require an inbound path into your network and cannot become a route in. Data is encrypted in transit with TLS 1.3 and at rest with AES-256, with key material held separately from the data it protects.

It is written to object-locked storage in an Indian region, replicated to a second Indian region under the same lock policy. On the Assure tier an additional air-gapped copy has no network path from production at all. Both primary and secondary copies remain in India by default; a cross-border copy exists only where you explicitly ask for one.

02 What we run, and why

Vendor-neutral in practice, not just in the brochure. Where your existing tooling is well chosen we will manage it rather than replace it — and where we do recommend a change, you get the specific reason rather than a partner-tier logo.

• Endpoint & detection — SentinelOne, CrowdStrike Falcon, Microsoft Defender for Endpoint, Wazuh, osquery
• Log analytics & SIEM — Elastic, OpenSearch, Wazuh, Vector, Fluent Bit, Sigma rules, MITRE ATT&CK
• Backup & recovery — Veeam, Restic, Rclone, AWS Backup, Azure Backup. Immutability is the selection criterion: if a platform cannot write to locked object storage, we do not use it
• Storage — S3 Object Lock, MinIO, AWS S3 (Indian regions), Azure Blob immutable
• Identity & access — Microsoft Entra ID, Active Directory, Conditional Access, FIDO2 passkeys
• Network & edge — Fortinet, Sophos, Cloudflare Zero Trust, Tailscale, WireGuard, Suricata
• Cloud & infrastructure — AWS, Azure, VMware, Proxmox, Terraform, Ansible, Docker