Security

Security is foundational to how we build and operate. We apply layered controls across infrastructure, application, data, and access — and we continuously improve practices as the GEXC portfolio grows.

• HTTPS/TLS for all public traffic
• CDN and WAF protection (Cloudflare)
• Rate limiting and bot mitigation on public forms
• HSTS and modern security response headers
• Cloud hosting with access controls and monitoring

• Input validation and typed schemas for form submissions
• Content Security Policy on public pages
• Parameterized database access via our application stack
• Separation of public site and CMS/admin surfaces
• Dependency and build hygiene in CI

Contact and inquiry data is validated server-side and stored in our database with access limited to authorized personnel. Secrets and credentials are managed through environment configuration and are not committed to source control. See our Privacy Policy for how personal information is handled.

Administrative access to CMS and production systems is limited to authorized GEXC personnel. We follow least-privilege principles and review access as roles change.

Launched portfolio companies maintain their own product security programs appropriate to their services. Shared GEXC Platform capabilities are designed to raise the baseline for identity, communications, and operational controls over time.

If you believe you have found a security vulnerability in gexc.com or a related GEXC Labs corporate system, please email security@gexc.com with:

• A clear description of the issue
• Steps to reproduce
• Potential impact
• Your contact information

Please give us a reasonable time to investigate and remediate before public disclosure. Do not access data that is not yours, disrupt services, or use vulnerabilities for exploitation beyond demonstration.

We maintain processes to investigate, contain, and remediate security incidents affecting our corporate systems, and to notify affected parties when required by law or contract.