Security
This page explains, in plain language, how N4XION AI protects your account and your data. N4XION AI is operated by N4XION Limited.
This is a working version of the document. The owner reviews it before public launch, so details may change as the service grows.
Sign in without a password
N4XION AI uses passwordless sign in. When you log in, we email you a short code. You enter the code to prove you control the address. We do not store passwords, so there is no password for anyone to guess, reuse, or steal.
The login codes are single use and short lived. We store them in hashed form rather than as plain text, so a copy of our records does not reveal a usable code.
Sessions and cookies
Once you sign in, we give your browser a session so you do not have to enter a code on every page. We store session tokens in hashed form and keep them in HttpOnly cookies, which means the cookie cannot be read by scripts running in the page. This reduces the risk that a script could take over your session.
Origin and request checks
We apply strict CORS rules and origin checks so that requests to our services are accepted only from places we expect. This helps block requests forged by other sites.
On sign in and other sensitive actions we use Cloudflare Turnstile to tell people apart from automated abuse, and we apply rate limits so a single source cannot flood the service with attempts.
Provider keys and secrets
N4XION AI routes each request to a suitable free AI provider through OPAW v1. The keys that let us talk to those providers are stored only as server side secrets. They live in the server environment, never in the pages you load, and we never expose them to your browser or return them in responses.
File storage
Files handled by the service are kept in private storage with access controls. They are not public by default, and access is limited to the parts of the system that need it to serve your request.
Audit logging
We keep audit logs of security relevant events, such as sign in attempts and sensitive account actions. These logs help us investigate problems and spot abuse. We treat them as sensitive and keep them only as long as they are useful for security.
Infrastructure
The service runs on Cloudflare infrastructure, including Pages, Workers, D1, Durable Objects, and R2, with Resend for email. We rely on the access controls and network protections these platforms provide as part of our own approach.
What we do not claim
No system is perfectly secure, and we do not claim that ours is. We also do not claim any security certification. What we describe here are the measures we actually use, and we work to improve them over time.
Report a security problem
If you find a security issue or something that looks wrong, please tell us. Email hello@n4xion.net with what you found and how to reproduce it. We will look into genuine reports and act on them.