Client data is isolated by project scope, encrypted in transit and at rest, and restricted strictly to personnel actively working on your deliverables. We treat all proprietary files, briefs, and personal details under standard UK data protection regulations, maintaining clear operational boundaries across our teams.
Departmental segregation and access controls
Xylora Groups LTD operates three distinct internal departments: Technology, Creative, and Operations & Client Services. Access to your project information is compartmentalised based entirely on operational necessity:
- Operations & Client Services: Manages contract documentation, billing records, ambassador tracking, and primary communications submitted via the Ask Xylo chat on this portal. They handle administrative records and liaise directly with you.
- Creative: Receives visual assets, brand guidelines, audio files, and scripts necessary for production. Creative team members have read-and-edit access to production assets for the duration of the project milestone only.
- Technology: Manages code repositories, database schemas, hosting environments, and integration keys. Server credentials and sensitive system keys are isolated within secure credential managers and never stored in open communication channels or shared project management boards.
No member of staff has blanket access to client systems unless required to fulfill a specific, scheduled milestone within your scope of work.
Ingestion and storage workflow
When you engage the studio, data moves through an established operational sequence:
1. Intake and Quoting: Briefs submitted through our portal or during bespoke quoting (issued within 48 hours of a completed brief) are logged in our central client management system. Referred client details are cross-referenced with the ambassador programme database to apply eligible discounts. 2. Project Provisioning: Upon payment of the invoice or deposit, a segregated workspace is provisioned. Working directories are provisioned with two-factor authentication requirements enforced across all participating internal staff accounts. 3. Active Production: All file exchanges take place through verified cloud infrastructure or direct repository transfers. Studio staff do not store working assets on unencrypted local drives. 4. Project Sign-off: Once deliverables are approved and final accounts are settled, production access permissions are revoked for temporary contractors or secondary contributors.
What clients must supply
To safeguard your operational security, you must adhere to standard security practices when supplying assets:
- Provide delegated user access or temporary staging credentials rather than primary root or administrative logins for website platforms and third-party tools.
- Send sensitive authentication details (such as API secrets or hosting tokens) via dedicated single-use, end-to-end encrypted transfer tools, never within open chat windows.
- Strip proprietary consumer data from test databases or raw sample files before providing them to our Technology or Creative teams.
- Ensure all team members authorised to interact with the studio through the Ask Xylo chat represent your organisation officially.
Retention and deletion schedules
We retain project files and client correspondence according to functional and legal requirements:
- Active Project Assets: Stored in primary production buckets for the duration of the contract.
- Completed Deliverables: Final master files are archived for internal reference and record-keeping following delivery sign-off.
- Administrative and Invoicing Records: Maintained for standard statutory durations in compliance with UK corporate accounting obligations.
- Client Deletion Requests: You may request the deletion of staging copies, sandbox databases, and non-statutory project briefs once an engagement concludes. Submit requests via the Ask Xylo chat on this portal during our working hours (Monday to Thursday, 09:00-17:00 GMT). We process verified deletion requests within our 24-hour initial response target and complete file purge actions within standard maintenance cycles.
Failure cases and incident procedures
If you believe an unauthorised third party has accessed an account, or if you inadvertently share live production credentials:
1. Revoke the compromised credential immediately within your own hosting or service environment. 2. Alert our Operations & Client Services team via the Ask Xylo chat. State the project reference, the specific data source affected, and the timestamp of revocation. 3. Our Technology department will isolate related staging environments, inspect deployment logs for irregular traffic, and clear cached credentials from our internal tools. 4. In the rare event of a suspected security event on studio infrastructure, affected clients will be notified directly in writing with technical details of the event and actions taken.
Client security checklist
Before transmitting files to our studio, confirm the following steps:
- [ ] Remove live customer personally identifiable information (PII) from mockups or staging databases.
- [ ] Create dedicated, revocable credentials for our Technology team instead of sharing master account details.
- [ ] Send sensitive keys using encrypted, self-expiring text links.
- [ ] Verify that team members messaging via the portal are authorised to direct project actions.