Security at Exeechain

What we actually have, and what we don't

This page describes the controls in place today. Where something is not built yet, it says so.

What we have: TLS 1.2+ in transit, AES-256 at rest, row-level tenant isolation on every query, scrypt-hashed passwords, revocable sessions, immutable audit logging, daily encrypted backups with point-in-time recovery, and read-only credentials to every system we connect to.

What we don't have yet:SOC 2 certification, and two-factor authentication of our own - use Sign in with Google, which carries your Google account's two-step verification. Both are on the roadmap; ask and I will tell you where.

Where your data goes: All AI inference runs in the United States. We do not route your data outside the United States or the EU, and no provider we use trains on your data.

GDPR and CCPA: a DPA on request, deletion within 30 days, no sale of data. We are not independently certified - the controls below are what we can show you.

Encryption

• In transit: TLS 1.2+ on every connection. HSTS enabled. No mixed content.
• At rest: AES-256 on PostgreSQL database volumes in the hosting environment.
• Application secrets: Held in the deployment environment's secret store, never committed to source control.

Access controls

• Workspace data is strictly tenant-isolated at the database query layer. Every query filters by workspaceId.
• Production database access is limited to two engineers, behind hardware-key 2FA.
• All admin actions on customer accounts are written to an immutable audit log (Settings → Audit Log).
• Principle of least privilege for all third-party integrations (read-only API keys wherever possible).

Authentication

• Authentication is first-party: we issue and verify our own sessions, so account credentials are never shared with a third-party identity provider.
• Passwords are hashed with scrypt (memory-hard, per-password salt). We never store them in a recoverable form, and we cannot read them.
• Password requirements: 10+ characters, with common and personal-detail passwords rejected. We do not currently check passwords against breach corpora.
• Sessions are database-backed and individually revocable: signing out, or changing a password, immediately invalidates the session everywhere rather than waiting for a token to expire.
• Failed sign-ins are rate limited per account and per IP address.
• Sign in with Google, and SAML SSO on Enterprise - with optional enforcement that refuses password sign-in for a claimed domain.
• Two-factor authentication is not yet available. It is on the roadmap; ask us if you need a date.

Infrastructure

• Hosting: containers we operate, behind Cloudflare.
• Database: PostgreSQL on a private network alongside the application, not exposed to the public internet.
• Backups: Daily automated, encrypted, restorable, with point-in-time recovery.
• DDoS: Cloudflare in front of every public endpoint.

Sub-processors

We use read-only, least-privilege credentials wherever the provider allows it.

Every vendor that touches customer data on our behalf, what it does, and where it processes.

• Anthropic (Claude) - Writes the narrative for a risk score, the drafted save emails, QBRs and Copilot answers. The numeric score is not produced by a model - it is a deterministic scorecard. Processes in: United States.
• NVIDIA NIM - Automatic fallback for the above when Anthropic is unavailable, so the product degrades rather than stops. Processes in: United States.
• Stripe - Read-only access to your billing data on paid plans: invoices, subscriptions, payment failures, renewal dates. Processes in: United States.
• Polar - Our own billing. Processes your payment details for an Exeechain subscription. Processes in: United States.
• Resend - Delivers email we send on your behalf, and our own transactional email. Processes in: United States.
• Sentry - Error monitoring. Receives stack traces and request context; not customer records. Processes in: United States.
• Upstash - Rate limiting and short-lived locks. Holds keys and counters, not customer data. Processes in: United States.
• Cloudflare - Sits in front of every public endpoint for DDoS protection and TLS termination. Processes in: Global edge network.
• Google - Sign in with Google, when you choose it. Receives the authentication request only. Processes in: United States.

Hosting

Exeechain runs as containers we operate, with its PostgreSQL database on a private network alongside the application rather than on a managed third-party database service. Backups are encrypted.

We are in the middle of moving hosts and would rather name the new one here than the old one. If you need the current provider and region in writing before you sign anything, email legal@exeechain.com and you will get a straight answer the same day.

Only if you connect them

These receive data only because you chose to link the account. Disconnect it and the flow stops.

• HubSpot - CRM context for scoring. Processes in: United States.
• Salesforce - CRM context and two-way sync. Processes in: United States.
• Intercom - Support conversations, as a churn signal. Processes in: United States.
• Zendesk - Support tickets, as a churn signal. Processes in: United States.
• Mixpanel - Product usage events. Processes in: United States.
• Slack - Where risk alerts are delivered, if you connect it. Processes in: United States.

Email security@exeechain.com for this list in writing.

Compliance

• GDPR: Not a certification anyone issues, so we will not claim one. What we do: a Data Processing Addendum on request, deletion within 30 days, no sale of data, and the controls listed above. Email legal@exeechain.com.
• CCPA: Same position. We do not sell or share personal information, and we honour access and deletion requests within 30 days.
• SOC 2: Not yet certified. Our controls are built to SOC 2 expectations - encryption at rest and in transit, application-layer tenant isolation (every query is scoped to the workspace), role-based access control, and audit logging - and we will engage a formal audit when an enterprise engagement requires it.
• HIPAA: Not currently. Do not upload PHI.

Vulnerability disclosure

Found a vulnerability? Email security@exeechain.com. We'll acknowledge within 24 hours and triage within 72. We do not currently offer a paid bounty, but we credit researchers in our public Hall of Fame and respond fast.

Incident response

Security incidents are classified Critical / High / Medium / Low and handled per our internal runbook. Customers affected by any incident rated High or Critical are notified by email within 72 hours per GDPR Article 33, with a post-mortem published within 7 days.

Reporting and audits

Customers evaluating us can request: a security architecture overview (covering tenant isolation, encryption, and access controls) and completed security questionnaire responses. Email security@exeechain.com.

What you can do

• Use Sign in with Google, which carries your Google account's two-step verification until we ship our own.
• Use SSO if you're on Enterprise.
• Review your team's seats regularly (Settings → Team).
• Rotate your API key if you suspect compromise (Settings → API Keys).