About Xyla
Xyla is a code security and compliance engine. It parses a repository into a typed semantic graph, proves each finding with the path that produced it, and states plainly what it could not establish. Prove the path. Test it. Record the decision.
- DPDP Actcompliant
- HIPAAcompliant
- ISO 27001 · 42001in progress
A finding with a severity and nothing else asks you to trust it.
Traditional scanners match syntax patterns against known-bad shapes. That is fast and structurally limited: it cannot prove a value actually flows from an untrusted input to a dangerous operation, so it either misses multi-hop vulnerabilities entirely or floods a team with unprioritised hits.
The cost of that is not the noise. It is that the reader has to go re-derive the answer by hand — which is what makes a noisy tool expensive rather than merely annoying. Xyla was built to hand over the derivation with the finding, and to say out loud where it is unsure.
Five phases, each producing evidence the next one uses
- 01PARSE
The repository is lowered into one typed semantic graph
- 02DETECT
Every detector reads that graph — no pattern matching on source text
- 03PROVE
Each finding is discharged by a witness trace, or it is not reported
- 04CONFIRM
Authorized probing turns a proven path into a verdict, or refutes it
- 05RECORD
Decisions append to a per-tenant hash chain that cannot be quietly edited
Four rules the product is not allowed to break
Proof, not suspicion
A finding without a path is an opinion. Every finding Xyla reports carries the trace that produced it — source, hops, sink — so the reader can re-derive the answer instead of trusting the label.
The caveat ships with the finding
When the engine suspects its own result, that caveat stays attached to the row. Filtering doubt to make output look stronger would remove the only thing here worth trusting.
Absence of proof is not risk
Reachability is unknown on roughly half of all findings. That is drawn as unknown — never as danger, and never as safety. Coverage is a count with its denominator, never a score.
We never certify
No code path lets the platform sign its own evidence. Xyla produces the artefact; your auditor reaches the conclusion.
One graph, two doors
Seventeen languages lower into the same graph, so a value that leaves a Java handler and comes back out of a Go service is one flow, not two findings. Security and compliance read that same graph — compliance findings carry the same evidence-and-citation shape as security findings, not a separate, weaker artefact.
Thirteen read-only connectors bring in cloud, identity, source control and endpoint evidence. Credentials are sealed on arrival and never returned, and write scope is never requested.
Xyla is built by Vclabs Enterprise Private Limited, and is a Vector Company product.
Bootstrapped, across two countries, building our own products alongside client work — one side keeps the other honest.
The team behind this →- CampX
- Anurag University
- Innovate Health
Together serving 5 lakh+ users. Xyla runs against the systems behind them.
