Trust and security

How we build

• Security by default. Access rights, data minimisation, encryption, logging and secure configuration are part of the first plan, not a final check.
• Reviews before release. Changes that touch personal data, accounts or payments get a security and privacy review before they go live.
• Data minimisation. We collect only the data a feature needs and keep it only as long as it is needed.

Data on this website

This website loads no third-party scripts, trackers, advertising or analytics. Our hosting chain (Lovable and Cloudflare) sets two technically necessary cookies and nothing else. If you write to us, we use your message to answer your request. The full details are in our privacy policy.

NIUJU photo facts

NIUJU, our AI portrait service, handles personal photos. This is what happens to them:

• Photos and results are stored in the EU (Ireland).
• The AI step can run outside the EU, mainly in the US, under a data processing agreement with EU Standard Contractual Clauses.
• Uploaded photos are deleted automatically 7 days after upload.
• Our AI provider does not use photos to train its models.
• Payments run through Stripe. We never store card data.

More in the NIUJU case study.

What we claim, and what we do not

XIVU and NIUJU are not ISO 27001 certified and hold no GDPR certification. We build with the GDPR in mind and align our work with ISO 27001. Our qualifications are personal to our founder, Chan Vu Luu, and we name them precisely: ISO/IEC 27001:2022 Lead Auditor qualification (TÜV NORD, CQI/IRCA-certified course), COBIT 5 Foundation, ITIL Foundation and Professional Scrum Master (PSM I). Our founder does not perform certification audits. They are also listed on the About page.

Report a vulnerability

Found a security problem on xivu.io or in NIUJU? Email contact@xivu.io. Please include:

• the affected address or feature,
• the steps to reproduce it,
• what an attacker could do with it.

Please do not access or change other people’s data, and give us a fair chance to fix the issue before you publish it. We confirm your report within 5 working days, keep you updated until it is fixed and credit you if you wish. We do not run a paid bug bounty. Our contact details are also in machine-readable form at xivu.io/.well-known/security.txt.