Product Privacy Report

xSimple VPN Privacy Policy

xSimple VPN delivers hardened, policy-aware remote access for field teams. The controls below outline how tunnel metadata, device fingerprints, and user activity are governed to maintain privacy across regulated environments.

Jump to Policy Back to XM LLC

Effective: May 1, 2024 · Next independent review: November 2024

Data Captured

Device posture signals (OS version, patch level, EDR status) necessary to enforce zero-trust rules.
Session metadata: tunnel start/stop time, assigned gateway, and service tags. Payload content is never inspected.
Optional location hints derived from gateway selection for latency optimization; precise GPS is never collected.

Processing & Retention

Metadata streams are encrypted (TLS 1.3) end to end and stored in customer-dedicated clusters.
Session logs roll off after 90 days unless preserved for an active investigation approved by the customer.
Device fingerprints are hashed with rotating salts to prevent cross-environment correlation.

Security & Access

Admin access requires hardware-backed MFA and is fully audited; support staff view redacted metadata only.
Forward secrecy enforced through short-lived certificates; compromised keys cannot decrypt historical sessions.
Continuous monitoring detects anomalous tunnel creation, with automated containment workflows.

Customer Controls

Customers define retention policies, approved geographies, and escalation contacts inside the admin console.
On-demand export packages include signed hashes for tamper evidence and SIEM ingestion.
XM provides quarterly privacy attestations aligned to FedRAMP Moderate and CJIS expectations.

Questions about this policy? Email privacy@xm-llc.com or call (202) 555-0184 to reach the XM privacy office in Milford, Connecticut.