Security at TableX

One sign-in, and only one

There are no standalone product logins anywhere in the TableX family. Every human sign-in goes through TableX single sign-on (SSO), and every product — the exercise platform, Presser, OmniReel — is reached from the signed-in board that SSO produces. There is no separate password for a product to phish, reuse, or lose.

What a signed-in person can see and do is decided by their organization's permissions, not by which product address they visit. If your organization does not have a product, its card does not appear on your board. Users verify their own phone numbers inside the platform, because some exercise features — such as a reporter calling a participant during a scenario — call the number on the account, and it has to be yours.

Organizations and permissions

TableX is organized into organizations. Membership, content, and exercise data are scoped to the organization they belong to: one organization's scenarios, runs, recordings, and reports are not visible to another.

• Participants join exercises, act in their roles, and see their own debriefs.
• Planners build scenarios and set up exercises for their organization.
• Facilitators run live exercises — releasing injects, managing the floor, and closing runs.
• Organization administrators manage their own organization's members, invitations, and settings.

Platform administration — operating TableX itself — is a separate function from organization administration. Administering your organization grants no access to the platform's operations, to other organizations, or to their data.

How data is handled

The Privacy Policy is the full statement of what we collect, why, and who processes it; this page does not replace it. The short version:

• Account, exercise, and communications data are processed to run the service, and are scoped to your organization as described above.
• The family products record what they are for: OmniReel stores talk recordings and the slide decks presented with them, and Presser stores practice session recordings — always inside the account that made them.
• Data is encrypted in transit, and access inside the platform is role-based, as described on this page.
• We do not sell personal information, and we do not use your content to train our own models.
• Service providers that process data on our behalf — cloud hosting, AI generation, and message delivery — are named in the Privacy Policy.

AI, disclosed plainly

AI is a working part of this product, not a backdrop, and we would rather name exactly where it acts:

• In exercises, AI participants play roles alongside human participants — asking questions, applying pressure, and acting inside the scenario.
• In Presser, AI hosts conduct the practice interviews and appearances you rehearse against.
• In OmniReel, automated analysis reads a recorded talk for filler words and pauses. That is the analysis that exists today; phrase-level checks and tone analysis are not built, and we do not claim them.
• Where content goes: when an exercise or rehearsal uses AI, the relevant scenario and session content is sent to our AI service provider to generate responses, as detailed in the Privacy Policy.
• What it costs: AI use is metered and budgeted per organization, so an organization's AI activity runs against its own budget — never an unbounded shared pool.

Our controls program — and SOC 2, honestly

TableX operates a documented controls program covering access control, change management, backup and recovery, and security monitoring. Changes to the platform ship through reviewed, tested releases, and the operating evidence that program produces is the same evidence our customers can ask to see.

TableX does not hold a SOC 2 report today, and we will not imply otherwise. SOC 2 readiness work is under way as a staged part of our platform program, and customers and prospects can request our current security documentation directly — write to us through the contact page and we will send what exists, described exactly as it stands.

Status and contact

Live service status for the TableX family is published on our status page, and product changes are recorded in What's New.

Security questions, vulnerability reports, and documentation requests: reach us through the contact page. Privacy matters are covered in the Privacy Policy, including how to exercise your rights.