Proving an exploit is real takes source code, credentials, and a live staging environment. This page sets out exactly what Xora does with each one — and what it never does.
Never your source code.
Not policies written down and hoped for. Each one is a property of how the system is built, which means it holds even when an agent misbehaves.
Whitebox analysis runs in ephemeral memory — read, scanned, discarded. Nothing persists to disk or survives the pentest.
AES-256 across findings, reports, and account records. Credentials carry a further layer — column-level encryption with per-tenant keys, decrypted only inside the sandbox at the moment of use and never written to a log.
A fresh, single-use sandbox per pentest — including repeat pentests from the same customer. No shared file system, process, or memory. Destroyed on exit.
Network egress is locked to your declared target scope at the infrastructure layer — a network guarantee, not a policy an agent could talk its way around.
A pentest runs in a sandbox with no route to the internet. Its only path out is an egress proxy that permits the hosts you declared and denies everything else. When the pentest ends, the sandbox and everything in it is destroyed.
Xora connects exclusively to staging and pre-production environments, removing production outage risk by design.
TLS 1.2+ in transit, AES-256 at rest. Credentials use per-tenant column-level encryption and are decrypted only transiently, inside the sandbox.
Every pentest gets a dedicated sandbox — including repeat pentests from the same customer — with no shared file system, process, or memory.
RBAC governs who can configure scope, view findings, and manage credentials. SSO is available for enterprise. Admin actions and scope changes are logged.
The layer a control lives in determines what can bypass it. These are grouped by where enforcement happens, not by what the control is called.
| Control | Enforcement | Layer |
|---|---|---|
| Encryption in transit | TLS 1.2+ on every connection between you, the control plane, and the sandbox | All surfaces |
| Encryption at rest | AES-256 across the findings database and evidence storage | Storage |
| Credential storage | Column-level encryption with per-tenant keys; ciphertext is all the control plane holds | Control plane |
| Credential use | Decrypted inside the sandbox at the moment of use, never logged, destroyed with the sandbox | Pentest sandbox |
| Source code | Cloned into memory for the duration of the pentest; never written to disk, never persisted | Pentest sandbox |
| Tenant isolation | A dedicated single-use sandbox per pentest — no shared file system, process, or memory | Pentest sandbox |
| Network egress | Deny by default. Private subnet with no internet gateway; all traffic forced through an allow-listed L7 proxy | Network |
| Environment scope | Staging and pre-production targets only — production is out of scope by design | Product |
| Model provider retention | Zero-data-retention terms with every inference provider — no storage after the request, no training on customer data | Vendor agreements |
| Access control | RBAC over scope configuration, findings visibility, and credential management | Control plane |
| Single sign-on | Available for enterprise accounts via your identity provider | Control plane |
| Audit logging | Admin actions and scope changes recorded and retained | Control plane |
The third parties that process customer data on Xora’s behalf, and what each one sees. We notify customers before adding a subprocessor that changes this list.
| Subprocessor | Purpose | Data processed |
|---|---|---|
| Amazon Web Services | Sandbox compute, secrets management, evidence storage | Pentest data in memory; encrypted evidence at rest |
| Neon | Managed Postgres for findings, reports, and account records | Findings, organisation metadata, encrypted credentials |
| Vercel | Hosting for the dashboard and marketing site | Request metadata |
| WorkOS | Authentication, SSO, and directory sync | User identity and session data |
| Anthropic | Model inference for analysis and exploit agents | Code and response excerpts during a pentest |
| OpenAI | Model inference for analysis and exploit agents | Code and response excerpts during a pentest |
| Baseten | Model inference for analysis and exploit agents | Code and response excerpts during a pentest |
| Langfuse | Cost and latency observability for model calls | Pentest metadata only — token counts, model IDs, timings. Prompt and response content never leaves our VPC. |
| Merge.dev | Ticketing integrations (Jira, Linear) | Finding summaries you choose to sync |
| Resend | Transactional and digest email | Email address, finding summaries |
| Marketing site analytics | Visitor IP and page activity on getxora.ai. No customer pentest data. |
Every model provider we use runs under zero-data-retention terms. Prompts and responses are not stored once the request completes, and are never used to train models — yours or anyone else’s.
| Framework | Status | Notes |
|---|---|---|
| SOC 2 Type II | Not yet certified | Readiness work is underway and we are selecting an audit partner. We will publish the observation window start date once it is set. |
| ISO 27001 | Roadmap | Planned following SOC 2 Type II completion. |
| GDPR | Aligned | The staging-only model limits personal data exposure. Data processing terms are agreed per contract. |
Ahead of formal attestation, our architecture — ephemeral execution, per-tenant encryption, staging-only scope, destroyed-on-exit sandboxes — is designed to satisfy the substance of the controls SOC 2 attests to.
Report a suspected issue to security@getxora.ai. We acknowledge within two business days.
Confirmed incidents affecting customer data are disclosed without undue delay, per your agreement with us.
Source code and sandbox state are never persisted beyond the pentest. Findings, evidence, and the execution log of the pentest remain in your account until you request deletion.
Nothing, because nothing was kept. Source is cloned into the sandbox's memory, analysed, and discarded when the sandbox is destroyed. It is never written to disk and never leaves the sandbox — what leaves the sandbox is the findings, their evidence, and the execution log of what the agents did.
No. The sandbox runs in a private subnet with no internet gateway, so there is no route to the internet for an agent to find. Its only egress path is a proxy that permits the hosts in your declared scope and denies everything else. This is enforced below the agent, so a confused or compromised agent cannot reason its way past it.
No. Xora connects only to staging and pre-production environments. That is a design decision, not a setting — it removes production outage risk entirely, and it is why the platform can attack aggressively enough to prove an exploit rather than just flag a pattern.
No, and neither do our model providers. Your code and findings are used only to carry out your pentests and produce your reports. Every inference provider we use runs under zero-data-retention terms, so prompts and responses are not stored once the request completes and are never used as training data.
Access is governed by RBAC within your organisation. Xora personnel access customer findings only when you request support, and those actions are logged.
Staging is where that risk belongs, which is the point of the staging-only model. Pentests are scoped to the targets you declare, and every action an agent took is in the pentest's evidence trail, so anything that broke can be traced to the request that caused it.
Not yet — we are not certified, and the observation window a Type II report covers has not started. We would rather tell you that than imply otherwise. The white paper and a signed NDA for deeper technical review are available in the meantime, and we will say so here the moment that changes.
The white paper covers everything on this page in a document your reviewers can file — architecture, controls, compliance status, and incident response.
Get our security whitepaperNeed an NDA for deeper technical review? security@getxora.ai