Certification status
For audit reports, attestation letters, and signed agreements (DPA, BAA), contact our team. NDA required before sensitive documentation is shared.
SOC 2 Type II
xpander.ai is SOC 2 Type II certified. The audit covers the Trust Services Criteria for Security, Availability, and Confidentiality, meaning an external auditor evaluated the platform’s controls over a period of time, not just on a single date, and confirmed they operated as designed. The report covers logical and physical access, encryption in transit and at rest, change management, incident response, backup and disaster recovery, and vendor management. The full report is available to current and prospective enterprise customers under NDA. Request the SOC 2 report.GDPR
The platform supports GDPR requirements for organizations processing EU resident data. Data residency is determined by deployment choice. In the Hybrid or Air-Gapped edition, runtime data (task execution, memory, knowledge base contents, audit logs) stays in the region you operate. Hybrid additionally syncs agent definitions, the connector catalog, and heartbeats with xpander Cloud — see what leaves the on-prem installation. xpander Cloud customers can request region-specific deployment for their workspace. Right to erasure and portability are exposed through the API and dashboard: conversation history, knowledge base documents, and user memories can be deleted on request; agent configurations and task history can be exported in standard formats. Privacy by design is enforced at the agent level via PII detection and masking. Both inputs and outputs can be automatically redacted before they reach the model or downstream tools. Controller relationships depend on the deployment model. For Managed Runtime customers (xpander Cloud), xpander is the data processor and the customer is the controller. For Unmanaged Runtime customers using their own AI service provider with private connectors, the customer is the controller and xpander’s privacy policy doesn’t extend to those processing activities. See the Privacy Policy for the full breakdown. DPAs and sub-processor lists are available with enterprise contracts.HIPAA, ISO 27001, FedRAMP
These three are in progress. While formal attestation is being completed, customers commonly bring xpander.ai under their own compliance program by deploying in their own infrastructure.- HIPAA: technical controls for handling PHI (encryption at rest and in transit, audit logging of all data access, isolation of customer data) are in place under SOC 2 coverage. Formal HIPAA attestation and Business Associate Agreement program in progress. For healthcare deployments, contact us about BAA availability and deployment configuration (typically Hybrid or Air-Gapped).
- ISO 27001: most control families overlap with SOC 2 Type II coverage. Certification in progress.
- FedRAMP: federal customers commonly deploy xpander.ai in the Hybrid or Air-Gapped edition under their existing Authority to Operate (ATO) while formal authorization is being completed.
Deployment patterns by industry
Common deployment patterns for regulated industries:
The platform isn’t the compliance boundary; your deployment configuration is. The platform provides the technical controls. Deployment choice determines which compliance program owns them.
Cloud Architecture
Hosted edition — TLS at ingress, managed keys, GDPR processor/controller
Hybrid Architecture
Data plane in your VPC; catalog and heartbeat sync to Cloud
Air-Gapped Architecture
Zero egress to xpander Cloud; signed Ed25519 license in-cluster
Supporting documentation
To request anything from this list, contact our team and describe what your security or compliance review needs. Enterprise customers receive ongoing access to compliance updates as new certifications complete.