Security and privacy

All client and account data is stored on AWS in Sydney (ap-southeast-2). It is handled under the Privacy Act 1988 and the Australian Privacy Principles, and we operate under the Notifiable Data Breaches scheme.

Letters are generated with the Anthropic Claude API using access that is opted out of model training. Your clients information is never used to train any AI model.

Every connection uses TLS 1.2 or higher, and all data is encrypted at rest. Nothing travels or sits in the clear.

Row-level security is enforced in the database itself, so each practitioner can access only their own clients and letters, never anyone else. This has been independently tested for access-control flaws.

Sign in with email and password, add optional two-factor authentication, and Solo accounts are pinned to one active session so a shared password cannot be used in two places at once.

We monitor errors to keep the service reliable, but client health information and personal identifiers are stripped out before any diagnostic leaves our servers.

A strict Content-Security-Policy, HSTS, anti-CSRF checks, and rate limiting are enforced on every request to defend against common web attacks.

Download any letter as a Word file at any time, and delete your account whenever you choose. After cancellation your data is kept for 30 days so you can export it, then permanently deleted.

All billing runs through Stripe (PCI DSS Level 1). XpressOT never sees or stores your card number.

XpressOT is built and tested against the OWASP Top 10, including independent penetration and access-control testing.