https://xpharma.ai/assets/security-and-data-D3RQzLJL.js

1const e=`## How xPharma handles your data
2
3Asset documents and structured data are some of the most sensitive material a biotech can share. xPharma is built so that every read is gated, confidential material never leaves the supplier's control without explicit permission, and you always know who has access.
4
5This page is a high-level overview. If you need details for a vendor security review, contact us at [[email protected]](mailto:[email protected]).
6
7## Authentication and access
8
9Every account is tied to a single email and an explicit set of roles. Suppliers can belong to multiple supplier organizations and switch between them. Buyers belong to a single buyer organization. Admins can view supplier or buyer portals for support purposes — but their access is read-only and traceable.
10
11Access decisions are enforced inside the platform's data layer rather than in the application — so they cannot be bypassed by the application code itself.
12
13## Document storage and confidentiality
14
15Uploaded documents live in private storage. Every read produces a short-lived link — there are no public file URLs, ever. Suppliers can mark any document as confidential at upload time or later; confidential documents are excluded from buyer views, search, and AI features entirely.
16
17## Authorization summary
18
19- **Suppliers** see their own assets, their own documents, and the buyer-facing preview of their own listings.
20- **Buyers** see published assets and their non-confidential documents.
21- **Admins** can read everything, with their actions logged for audit.
22- **Anonymous visitors** see only the marketing pages — there is no public marketplace browsing.
23
24## What we do not do
25
26- We do not sell or share asset data with third parties.
27- We do not train external AI models on supplier documents.
28- We do not surface confidential documents in search, chat, or any public view.
29- We do not give third-party apps access to your data without your explicit, scoped consent.
30`;export{e as default};