How we protect your account and your idea.
Your application is confidential, and the account that holds it is protected with the same practices we'd want for our own. Here's what's actually in place — no vague reassurances, just what's built.
Password hashing
Passwords are never stored in plain text. Each one is salted and run through a slow, industry-standard hashing algorithm before being written to our database, so a database leak alone can't recover your password.
Optional two-factor authentication
Every account can enable 2FA — either an authenticator app (scan a QR code or enter a setup key) or a one-time code sent by email. It's not mandatory, but we recommend turning it on. Single-use recovery codes are provided as a backup, and you can regenerate your authenticator enrollment at any time.
Encrypted 2FA secrets
If you enroll an authenticator app, the underlying secret is encrypted at rest — it's never stored or displayed in plain text after setup, and it never leaves your browser except in encrypted form.
Session management
See every device currently signed into your account, log out any single session remotely, or end all other sessions at once — all from your dashboard's Security panel. Session cookies are HttpOnly and transmitted only over HTTPS.
Rate limiting
Login attempts, application drafts, and messages are all rate-limited server-side, independent of any browser-level protection, to make brute-force and abuse attempts impractical.
Confidential by default
Applications are visible only to the Xylento review team. They're never shared with third parties and never used to train automated systems.
Your account, your data
Founders can permanently delete their account and personal data from the Security panel at any time — no support ticket required. Application records that were part of a locked, paid review are retained as the historical record described in our Privacy Policy, but your personal profile information is scrubbed on deletion.
Questions about anything here, or to report a security concern: [email protected]. More account and process questions are answered in the full FAQ.