For your IT and cybersecurity reviewer

Security

Reviewed 8 September 2026 · Version 1.0 · Questions to info@drillx.app

This page is written for the person who has to approve DrillX before it touches an operating rig. It states what is true today and what is not yet true, because a security statement that overclaims is worse than none.

Design commitments

Control	How it works
No invented data	Every field in every generated document traces to a sensor reading, a prior approved document or a human keystroke. If the system cannot identify the source, the field is left blank. This is enforced in the generation logic, not by policy.
Receive only at the rig	The wellsite ingest reads the EDR's WITS output over a serial or TCP link. There is no write path back into the drilling control system, by design and by physical wiring.
Separation of duties	The person who records lost time cannot classify the account it is charged to. Approval requires a different named person, recorded on the document.
Immutable records	A countersigned tour sheet locks. Later changes create a new revision with an audit trail; nothing is overwritten.
Original wording retained	Text entered in Arabic is kept verbatim as the record. The English rendering sits alongside it and never replaces it.
No model training on client data	Client operational data is never used to train models, and never used to serve another client.
Data residency	Client deployments are hosted in the client's own jurisdiction and under the client's own domain where the contract requires it.

Platform controls in force on drillx.app

Control	Status
Transport	HTTPS only. `.app` is on the browser HSTS preload list, so plain HTTP cannot load. HSTS max-age 31536000 with includeSubDomains.
Content Security Policy	Enforced. Scripts restricted to same-origin and one named CDN; frame-ancestors restricted; no inline third-party trackers permitted.
Other headers	X-Content-Type-Options nosniff, X-Frame-Options SAMEORIGIN, strict-origin-when-cross-origin referrer policy, restrictive Permissions-Policy.
Third-party trackers	None. No advertising, analytics pixels, session recording or fingerprinting.
Demonstration data	Stored in the browser on the user's own device. Never transmitted to us.
Dependencies	Two client-side libraries for PDF rendering, served from a public CDN with the policy above. No server-side application dependencies on the public site.

What is not yet true

Stated plainly so nobody is surprised in a review.

DrillX is not yet ISO 27001 certified. The platform is built to those controls; the certification has not been obtained.
There has been no third-party penetration test to date.
There is no SOC 2 report.
Authentication on the public demonstration is device-level identification, not authenticated access control. Production deployments authenticate against the client's own directory.
The public site carries no uptime commitment. Service levels apply only under a signed agreement.

Each of these is a known gap with a cost and a timeline, and we will discuss both openly during procurement.

Reporting a vulnerability

If you find a security issue, email info@drillx.app with enough detail to reproduce it. We will acknowledge within three working days. Please do not test against a client deployment, and please give us a reasonable period to remediate before disclosure. We do not currently operate a paid bounty.

Before a pilot

For a client deployment we expect to complete your vendor security questionnaire, agree a data processing agreement, confirm hosting region, and provide a sub-processor schedule with change notice. Ask and we will start that pack before the commercial conversation, not after.