Trust Center
You probably have a question from a reviewer. This page tells you which policy answers it and what you can check for yourself without asking us. The policies cover what we collect, how the site is protected, how we use AI, and the terms that govern our work.
In this center
What does the Trust Center cover, and what does it leave to the scope?
It covers this website, and how we handle a client's information and any AI used on it while we work. It does not describe the products in development, which will publish terms of their own. It also stops short of commitments that belong to a single engagement. Response times, how long client data is kept, who may read our notes and who owns each deliverable are set in the statement of work, and only what is written there applies.
Which policy answers which question?
Find your question below, then open the policy it points to.
| The question | The policy | What it settles |
|---|---|---|
| What does your website collect about me, and who sees it? | Privacy Policy | Where the site collects information and why, who can see it, how long it is kept, and how to have it corrected or deleted. |
| What does the site store in my browser? | Cookie Policy | The cookies the site sets, the purpose of each, how long each lasts, and how to change your choice. |
| Which terms govern an engagement? | Terms and Conditions | How an engagement is agreed, delivered, accepted and ended, with confidentiality and the limits of our commitments. |
| Who is accountable for our data, and for any AI used on it? | Data and AI Governance | The accountable person on each side, what we may see, our role regarding personal data, and what happens to client information at the end. |
| How do you use AI in your own work? | AI Use Policy | Where AI is and is not used on the site, in client work and in what we publish, and the limits we set. |
| How is the website protected? | Security | The protections the site has today, who can change it, and what we do not claim. |
| Who owns what? | Copyright and ownership | What belongs to XONIK, what you may quote, how the XONIK name may be used, and how ownership of client work is set. |
| What may I do with the site and its tools? | Acceptable Use Policy | What is allowed, what is not, and what we may do if the rules are broken. |
| How far can I rely on what you publish? | Disclaimer | Research is practitioner analysis and not advice, tools are self-assessments and not audits, briefings are accurate as of their date, and no result is promised. |
| Can I use the site with assistive technology? | Accessibility Statement | The standard we build to, how we test it, and what we have not verified. |
| I have found a weakness in your site. | Responsible Disclosure | How to report it, what we ask of you while you do, and what we do in return. |
When is a policy enough?
A policy here settles it if
- Your question is about this website, its forms, cookies, tools or downloads.
- You want to know our general rules for AI, access and confidentiality.
- A reviewer needs a document that is the same for every client.
Ask for it in the scope if
- You need a response time or support hours for an engagement.
- You need client data held in a stated place, or deleted on a stated event.
- You need named people to have access and others not to.
- The ownership of a deliverable must be settled for your counsel.
Writing it into the scope takes a conversation before work starts. In return both sides read the same text, and a number mentioned in a proposal is not a commitment until it is written there.
What do reviewers ask before they approve us?
Do you hold a security certification?
We claim none, and the Security policy says so. It describes the protections this website has today, who can change it and what we do not claim. For a client's information during an engagement, the Data and AI Governance policy and the statement of work apply instead.
Where will our data be held, and when is it deleted?
That is set in the statement of work, not in the Trust Center. The Data and AI Governance policy names the accountable person on each side, what we may see and what happens to client information at the end. If you need a stated place or a deletion event, it goes in the scope.
Do you use AI on our information?
The AI Use Policy sets out where AI is and is not used on the site, in client work and in what we publish. For your engagement, the Data and AI Governance policy covers who is accountable for any AI used on your data, and anything more specific goes in the scope.
How do I get a document for our procurement review?
Ask through the Discuss page and say which document the reviewer needs. A senior person replies. Commitments that belong to one engagement, such as response times, go into the statement of work, and only what is written there applies.
What you can verify
What can you check without asking us?
- The cookie list
- The cookie table is built from the cookie list the site itself uses, so it cannot say one thing while the site does another.
- The security contact
- Our security address is published in the standard security.txt file, where researchers and automated tools look for it.
- The tools
- Each assessment and calculator publishes its scoring rules, and the arithmetic runs on your own device. Nothing you enter travels to our servers.
- What we do not claim
- We claim no security certification, and we have not verified that every page meets the accessibility standard. Both policies say so.
Data, AI and the site
Policies on how we handle information.
Terms and notices
Terms that apply, and limits on what we publish.
Need a document for procurement?
Name the document your reviewer needs and the question behind it. A senior person replies, and anything that belongs in the statement of work gets said then.