Who Can Access Your Business Data? How XAP.ai Limits Access

Who can access your business data on XAP.ai? A direct answer to a direct question: exactly who, and what, can see it, and how access is controlled.

The short answer: Access to your business data on XAP.ai is deliberately restricted, enforced in code rather than left to individual discretion, and tested. XAP is not claiming that every part of its service is sealed off from its own operators today. A full account of how your data is processed and stored is being finalised. For background on the technology, see our guide to Trusted Execution Environments.

1. How XAP limits access to your business data

XAP’s aim is that access to your data is limited by design, not by good intentions alone. XAP is not claiming that every part of its service is sealed off from its own operators today. A full account of how your data is processed and stored is being finalised.

2. Can XAP.ai’s own team read my business data?

Access is deliberately limited and enforced in code, not left to individual discretion. A full account of how your data is processed and stored is being finalised.

As one concrete, tested example: our systems are built so that infrastructure-level information and internal commands are restricted from general users by default, with access genuinely limited to specific, verified accounts. This has been directly verified through real security testing — including testing performed by outside, unprivileged accounts specifically to confirm the restriction actually holds in practice, not just on paper.

3. What can a member of the public see?

If you talk to XAP.bot — our free, publicly available agent — your conversation is private to you. Other users of XAP.bot cannot see your conversation, your data, or even that you’ve used the service, in the same way that messaging any private bot on Telegram works.

4. Does paying for XAP Advisor grant more system access?

No. Why we think this distinction matters: being a paying XAP Advisor client changes what product features you have access to. It does not, and will not, grant access to infrastructure-level commands or internal systems that are otherwise restricted.

Why this matters: we treat ‘what you’re subscribed to’ and ‘what system-level access you have’ as two permanently separate questions. A paying customer gets a better product experience — not a backstage pass to how XAP.ai’s systems work internally. We think that’s the right way to build trust, not just a technical implementation detail.

5. How long is data kept, and who can act on it?

Free-tier conversation data (via XAP.bot) follows an automated lifecycle, not indefinite storage:

This lifecycle runs automatically — it doesn’t depend on someone remembering to clean up old data manually. For XAP Advisor (paid) clients, we’re finalising a policy that reflects the nature of an ongoing advisory relationship, and will publish it here once confirmed rather than commit to specifics prematurely.

6. Your everyday financial data

Everything above covers how access to XAP’s systems works. XAP Books, the accounting product, is in development, and its day-to-day transaction data (invoices, bank entries, payroll) will need its own protection model. We want to be precise about that rather than blur it.

XAP Books is in development. A full account of how it stores and protects your records will be published before it launches.

One thing we can already say plainly: the ledger itself will not be zero-knowledge. We’d rather tell you this than round it up to a bigger claim than it is.

Related articles:

Last updated: 16 October, 2026 | XAP.ai