Skip to content
Legal Centre/Trust & Security

Trust & Security

Version 1.0Effective 15 January 2026Last updated 15 January 2026

This Trust Centre summarises the controls we operate today. It is maintained by the Exeaura team and reflects app-visible practices, not independent certification.

1. Shared responsibility

Security is a partnership. Exeaura OS is responsible for the security of the platform, the executive intelligence orchestration layer, and the infrastructure it runs on. You are responsible for keeping your credentials safe, enabling MFA where offered, choosing which content to upload, and reviewing AI output before you publish. This page describes the controls Exeaura operates and enables today. It is maintained by the Exeaura team and is not an independent certification.

2. Encryption

In transit
  • TLS 1.2+ everywhere (HSTS enforced)
  • HTTP/2 and modern cipher suites
  • Certificates auto-rotated
At rest
  • AES-256 database and storage encryption
  • Encrypted, versioned backups
  • Encrypted secrets vault for API keys

3. Authentication and access

Users
  • Email + password with password hashing
  • Google OAuth
  • Session tokens rotated on sensitive actions
  • Row-level security on every user-scoped table
Employees
  • SSO with hardware-key MFA
  • Least-privilege access to production
  • Break-glass access reviewed and logged
  • Access reviews every quarter

4. Infrastructure

Hosting
  • Managed edge hosting with global CDN
  • Production data services currently hosted in the Asia Pacific region
  • DDoS protection at the edge
Isolation
  • Per-tenant row isolation via RLS
  • Signed webhooks with HMAC verification
  • Least-privilege service roles

5. Monitoring and observability

Application
  • Sentry error and performance monitoring
  • IGOF traces for every AI request
  • Structured logs with PII scrubbing
Operational
  • Multi-component health service
  • Real-time ops_alerts with severity routing
  • 24/7 alerting for critical breakage

6. Availability and disaster recovery

We target 99.5% monthly availability on standard plans and offer an SLA on Enterprise. Point-in-time recovery is enabled with a 35-day window. We test failover and restore quarterly.

7. Secure development

Code
  • Peer review on every change
  • Automated typecheck and lint on every push
  • Dependency vulnerability scanning
Runtime
  • Automated security linting on database schema
  • RLS-required-by-default check
  • Secrets never checked into source

8. Incident response

We follow a documented runbook: detect, triage, contain, eradicate, recover, post-mortem. Confirmed customer-impacting security incidents are notified without undue delay and within 72 hours where GDPR applies. Enterprise customers receive dedicated incident communication under their order form.

9. Responsible disclosure

If you believe you have found a vulnerability, please email security@exeaura.ai with reproduction steps and impact. We commit to acknowledging within 3 business days, working with you in good faith, and not pursuing legal action against researchers who follow this policy.

Please do not exfiltrate data, degrade service, or access accounts other than your own. Testing is out of scope for third-party services (LinkedIn, payment providers, model providers) — please report to them directly.

10. Compliance roadmap

Exeaura is building its compliance programme toward recognised assurance frameworks. Current controls, data-handling practices and contractual commitments are described on this Trust Centre; formal certifications will be stated here only after they are independently achieved.

11. Security contact

Security questions, vulnerability reports, or SIG/CAIQ requests: security@exeaura.ai.