Private by default
Internal XML, partner samples, and test fixtures stay out of any public index. Nothing you ingest is shared or surfaced beyond your workspace.
Security posture
Designed for sensitive payloads.
XMLDir is built to hold the XML you can't put anywhere public — partner payloads, internal feeds, and redacted samples — with isolation enforced where it counts.
Per-user isolation
Every source and document is owned by the account that created it, enforced at the database level with PostgreSQL row-level security — not just in application code.
Redaction-ready
Keep the structure and quirks that matter for debugging while stripping identifiers, tokens, and personal data before sharing examples with the team.
Audit-friendly
Source URLs, upload context, validation status, and full change history are preserved, so you can always answer what changed, when, and where it came from.
Engineering practices
- Server-side ingestion validates and size-limits every document before storage.
- Outbound fetches are guarded against private and reserved network ranges (SSRF protection).
- Secrets and privileged keys never reach the browser.
- Transport is encrypted end to end over HTTPS.
Have a specific security or compliance question? Contact us.
Early access
Bring order to the XML your team can't afford to ignore.
XMLDir is opening private-beta conversations with teams running production XML feeds, sitemaps, schemas, and vendor integrations.