SOC 2 Type II
Gap assessment completed against AICPA Trust Services Criteria. Certification is on the product roadmap.
Platform Foundation
The architecture, the controls, the boundaries.
What XylaWorks runs on, how it is governed, what each party in a deployment can see, and which frameworks the compliance program is built to. For procurement, IT, information security, and compliance reviewers evaluating XylaWorks for institutional deployment.
For the methodology itself — what the 3-Dimensional Leader Framework measures and how assessments are produced — see Career Intelligence.
Architecture
Cloud-native on Azure. Infrastructure-as-code. Audit-logged end to end.
XylaWorks runs on Microsoft Azure with managed identity for service authentication, private networking for data and AI services, and encryption in transit and at rest. Infrastructure is managed as code. Production and staging run as separated environments with manual gating between them.
- Deployment
- Azure Container Apps under infrastructure-as-code, across separated staging and production environments with manual gating between them.
- Edge
- Azure Front Door with WAF and traffic inspection at the edge. Managed API gateway in front of the application tier.
- Application
- Containerized application and asynchronous workers on private networking.
- Data
- Azure PostgreSQL Flexible Server, Azure Cache for Redis, and Azure Blob Storage on private endpoints. Secrets in Azure Key Vault, accessed via managed identity with no stored application credentials.
- AI services
- Governed foundation model services on Azure AI accessed via managed identity over private networking. Content safety filtering on every AI execution, before delivery.
- Observability
- Azure Application Insights for traces, metrics, and dependency telemetry. Tamper-evident audit logging across application, worker, and AI services.
Security and identity
Controls scoped to what the system actually does.
- No stored service credentials.
Azure managed identity replaces stored keys across the stack. Secrets sit in Key Vault and are retrieved at runtime.
- Private data paths.
Data and AI services are reached over private endpoints, not over the public internet.
- Encryption in transit and at rest.
TLS in transit. Encryption at rest across data stores, governed by the Encryption and Key Management Policy.
- Session handling.
HTTPOnly session cookies. Session tokens are never exposed to the application client.
- Content safety on AI outputs.
Every AI-generated output passes through Azure AI Content Safety before it reaches the user.
- Tamper-evident audit logs.
Audit logs are insert-only and immutable. Every AI execution, every access-code redemption, and every approval-state transition is recorded.
- Two-principal governance of production.
Production deployment, incident response, and continuity actions require two-principal authorization — a compensating control documented across Change Management, Incident Response, and Business Continuity policies.
- Separated environments.
Production and staging run independently. Promotion is manually gated.
AI governance
AI-powered. Human-governed.
Every AI-generated output moves through a three-state approval pipeline before it reaches the candidate — processing, awaiting approval, approved. The approval state is a database field, not a user interface flag. An output that has not reached approved is not accessible to the candidate and is not included in any report.
The governance pipeline is the architecture. Every output is validated against the 3-Dimensional Leader Framework, filtered for content safety, and audit-logged end to end. Every recommendation traces back to a dimensional signal in the candidate's submitted material.
Reporting boundaries by scope
What each party sees. What stays private.
XylaWorks operates across four relationships with different data boundaries. The matrix below is the authoritative reference for what is visible in each. Channel pages reference this matrix; this is where the architectural lines are drawn.
| Data category | Candidate | Employer | Institution | Workforce Program |
|---|---|---|---|---|
| Access code redemption (named, timestamped) | N/A | Visible | Visible | Visible |
| Engagement signals (active flag, frequency) | Full | Per-redemption | Per-participant + aggregate | Per-participant + aggregate |
| Uploaded materials (résumé, submitted artifacts) | Full | Not visible | Read-only | Read-only |
| Platform outputs (guidance, strategy, documents) | Full | Not visible | Read-only | Read-only |
| Tier selected and upgrade activity | Full | Not visible | Visible | Visible |
| Positioning score | Full | Not visible | Read-only | Read-only |
| Candidate reflective inputs (narrative, direction) | Full | Not visible | Not visible | Not visible |
| Aggregate cohort / program reporting | N/A | Redemption-level only | Available | Available |
The candidate's reflective inputs — the personal narrative and direction the candidate provides to ground the assessment — remain private to the candidate across every channel. This is the one boundary that does not vary by deployment.
Compliance program
SOC 2-aligned policy suite. Framework-mapped.
The compliance program is built on the AICPA Trust Services Criteria as the primary framework and is mappable to NIST CSF 2.0 and ISO/IEC 27001:2022 Annex A. Twelve Tier 1 policies, approved by the CEO and owned by the CTO, govern the program:
- Information Security Policy — the umbrella commitment governing the information security program.
- Access Control Policy — provisioning, modification, review, and revocation of access.
- Data Classification and Handling Policy — classification scheme and handling requirements by sensitivity.
- Encryption and Key Management Policy — cryptographic protection in transit and at rest, key lifecycle.
- Change Management Policy — review, testing, authorization, and traceability of all production changes.
- Vulnerability Management Policy — identification, prioritization, and remediation of vulnerabilities.
- Incident Response Policy — detection, containment, eradication, recovery, and post-incident review.
- Business Continuity and Disaster Recovery Policy — recovery objectives, backups, and tested recovery capability.
- Vendor and Sub-processor Management Policy — diligence, contracting, monitoring, and offboarding of third parties.
- Risk Assessment and Management Policy — risk identification, evaluation, and treatment.
- Human Resources Security Policy — personnel screening, training, and access lifecycle.
- Acceptable Use Policy — permitted use of company systems and data.
GDPR and CCPA
Subject access request handling is implemented via a dedicated data export service. Data deletion follows a documented runbook with defined completion windows.
Institutional deployments
The reporting boundaries above are enforced at the data layer. Institutional compliance specifics — including scope of student record handling under applicable frameworks — are reviewed in the procurement briefing for each deployment.
The methodology, briefly
The 3-Dimensional Leader Framework.
Every assessment the platform produces is built on the 3-Dimensional Leader Framework — Demonstrated Competence, Professional Credibility, Meaningful Contribution. The full methodology is described on Career Intelligence. The research foundation is documented in our four-paper foundational series on Insights.
Evaluating the platform for your organization?
A briefing covers the technical architecture, security posture, data-handling practices, and compliance mapping specific to your channel and framework.
Confidential. No obligation.