Security and data

DMS builds and runs xEllerator

DMS is a consulting firm in Metuchen, New Jersey, that works on AI governance and cybersecurity. Research from ISE&S board members drove the idea behind the kind of mentoring the app supports.

Dr. Deborah Mohammed-Spigner is on the ISE&S founding board and is CEO of DMS. The programme team that runs the pilot is six people from DMS and the ISE&S board.

Railway hosts the app and its database

The app and its Postgres database run on Railway, in Railway's US East region in Virginia, USA. The app reaches the database over Railway's private network. Railway says traffic on that network is encrypted with WireGuard.

Railway says it holds SOC 2 Type II and SOC 3 certification (Railway's compliance page). That certification is Railway's, as the host. It does not cover xEllerator.

The site works only over HTTPS

A plain HTTP request is sent on to HTTPS, and every answer tells the browser to keep using HTTPS for a year, subdomains included (HSTS).

Every page carries a content security policy. Pages can run only the site's own scripts, and no other site can show xEllerator inside a frame. The policy still allows inline styles, which the pages use. This is the policy as sent:

default-src 'self';
script-src 'self';
style-src 'self' 'unsafe-inline';
font-src 'self';
img-src 'self' data:;
connect-src 'self';
frame-ancestors 'none';
object-src 'none';
base-uri 'none';
form-action 'self'

Pages load nothing from other companies' servers. The fonts, images and scripts all come from xEllerator itself, and there are no advertising or analytics scripts. Answers from the sign-in and data routes are never cached.

Sign-in protections

People join from the email invite that HR sends, and fill in their own profile.

• Each network address can make 12 requests a minute, in all, to the pilot form and the routes that start a sign-in. Each account also has a limit on how often it can ask to sign in within 10 minutes.
• The sign-in form gives the same answer at the same speed whether or not an email has an account.
• Signing out ends the session on the server. A session also ends after 30 days, and at once when HR deactivates the person.
• The session cookie is signed, is sent only over HTTPS, and cannot be read by scripts on the page.

Access to people's data

Each organisation

All organisations share one database. Every record carries the organisation it belongs to, and HR's screens read only their own organisation's records. Tests check that one organisation's HR cannot see or change another organisation's people or matches, and that its mentees and mentors cannot write to another organisation's matches.

HR

HR sees the names, matches and progress of people in their own organisation. For check-ins and outcomes, HR sees only figures for groups of 5 or more people.

The other person in a pair

Check-in answers and requests for support never reach the other person. A mentor's private session notes and a mentee's takeaways are seen only by the person who wrote them.

The programme team

The six people who run the pilot see names across organisations, and every match with its score and reason. On the team's page they read check-ins, the mentee's short answers after each session, requests for support, and what the pair said about the sponsorship the mentor logged, pair by pair. That page leaves out a pair the reader is in, and every pair in an organisation where the reader is HR. The admin console's lists of people and matches show every pair.

Logged reads

When the admin console loads people's data, the app logs who looked, which page and which organisation. A repeat of the same read within 10 minutes is not logged again. This covers the people list, matches, equity figures, match explanations, pilot applications and the programme team's page. The Pathway report, which shows only group figures, is not in this log. The entry holds no content, and HR cannot see the log. If the entry cannot be written, the data is not sent.

Small groups

A group's figures are shown only if it had 5 people or more when they were worked out. An organisation with fewer than 5 active mentees sees no group figures. Figures come from a snapshot saved once a week, and a group's figures change only after at least 5 people or answers behind them have changed, so one person's change does not show on its own.

When a group is hidden, others may be hidden too. That way its figures cannot be worked out by taking the shown groups away from everyone. The size of a hidden group can sometimes be worked out from the total. Some other combinations of figures, and some readings across weeks, are not checked yet.

Consent for outcomes

At the end of a match, a mentee is asked whether her answers can be counted in programme figures. The box starts unticked. Answers about promotions, moves and confidence are counted only if she ticks it. Without it, they are kept but never counted.

The activity log

The app logs what happens, such as a goal added or a match accepted. Each entry is a fixed phrase from a closed list, with ids for the people and things involved. It never holds text that anyone typed, such as notes, comments, goals or written reasons. The code refuses an entry with its own message or an unknown type, and tests check that no typed text reaches the log.

AI in the app

The app uses two OpenAI models: gpt-4o-mini for text, and text-embedding-3-small for comparing text by meaning.

The model's tasks

• It reads what each person wrote when they joined and picks out the skills and goals in it. The app compares these by meaning, so "Get better at presenting" can find a mentor who coaches public speaking.
• It writes the reason shown with each proposal. It is given only the facts behind the score and told to use nothing else.
• It writes a short summary of a match for the programme team.
• It drafts up to three goals for a mentee from her own answers. She keeps, changes or discards each one.

Scores and release

• The skills factor uses the embedding model to compare her needs with the mentor's offers. The app adds up the factors with fixed weights, which are shown on the home page, and ranks the pairings with its own rules.
• Neither person in a pair sees a proposal until HR releases it. Then the mentee and the mentor each accept or decline.

Prompts

• For the joining answers: the person's role, job title, career stage, years of experience, field and their own answers. Their name, email address and gender are left out.
• For a proposal's reason: both people's names, job titles and career stages, the needs and offers that match, her stated goals, how well they fit on the other factors, and what access the mentor can open, such as sponsorship or introductions.
• For a match summary: both people's names, job titles and career stages, the scores, her stated goals, the reason shown to her, and the equity signals behind the uplift on both sides. Her signals can say that she has no sponsor, has had no recent promotion, took a career break, has little access to networks, or is underrepresented, which uses her gender. The model is also told when her gender preference was not met.
• For goal drafts: her target role, her goal for the next one to two years and what she most needs help with.
• Check-in answers, private session notes, takeaways and requests for support never go to the model.

Limits and fallback

The app estimates what each AI call costs from its own price table. By that estimate, a match run can spend at most $20, and all AI spend is capped at $5 a day for the platform and $2 a day for each organisation. The totals are kept in the database, so the caps hold across restarts. Two runs at the same moment can go over a cap by the cost of the calls they have in flight. With no key, at a cap, or when a call fails, the app uses word matching and written templates instead, and the match run still finishes. Model answers are cached on the app's server, and a cached answer is not asked for again.

OpenAI's rules for data sent to its API are on OpenAI's site.

HR reviews every proposal

Neither person in a pair sees a proposal until HR releases it. HR can instead withhold it, with a reason from a fixed list: a reporting line, a prior relationship, a conflict of interest, or another reason with a note. HR cannot re-rank proposals, choose a different mentor or change a score. Each withhold is logged, and that pairing is not proposed again. The Equity page shows the share of proposals HR withheld for each group.

DMS compared this design with the four functions of the NIST AI Risk Management Framework. The framework is voluntary, and there is no certificate for it. The comparison is DMS's own.

Other companies the app uses

No other company gets data from the app.

Not available yet

• A SOC 2 report or an ISO 27001 certificate of its own.
• A way to delete a person's data. HR can deactivate someone, which takes them out of matching, ends their sessions and keeps their history.
• A set period after which old records are deleted.
• Sign-in through your organisation's own identity provider (single sign-on).
• Encryption of stored records by the app itself. Stored data is kept in Railway's database service.
• A log of what is read on the IT operations page. One person at DMS can open that page.

Reporting a security problem

Email DMS at info@strategydms.com with "xEllerator security" in the subject. Say what you found and how to see it again. Please do not open or change other people's data while you check.

The same contact is in /.well-known/security.txt.