Proving an exploit is real takes source code, credentials, and a live staging environment. This page sets out exactly what Xora does with each one, and what it never does.
Never your source code.
Not policies written down and hoped for. Each one is a property of how the system is built, which means it holds even when an agent misbehaves.
Whitebox analysis runs in ephemeral memory: read, scanned, discarded. Nothing persists to disk or survives the pentest.
AES-256 across findings, reports, and account records. Credentials carry a further layer — column-level encryption under a separate key the database never holds, decrypted only inside the sandbox at the moment of use and never written to a log.
A fresh, single-use sandbox per pentest — including repeat pentests from the same customer. No shared file system, process, or memory. Destroyed on exit.
Network egress is locked to your declared target scope at the infrastructure layer. It is a network guarantee, not a policy an agent could talk its way around.
A pentest runs in a sandbox with no route to the internet. Its only path out is an egress proxy that permits the hosts you declared and denies everything else. When the pentest ends, the sandbox and everything in it is destroyed.
Xora connects exclusively to staging and pre-production environments, removing production outage risk by design.
TLS 1.2+ in transit, AES-256 at rest. Credentials use column-level encryption under a separate, rotatable key and are decrypted only transiently, inside the sandbox.
Every pentest gets a dedicated sandbox — including repeat pentests from the same customer — with no shared file system, process, or memory.
RBAC governs who can configure scope, view findings, and manage credentials. SSO is available for enterprise. Admin actions and scope changes are logged.
The layer a control lives in determines what can bypass it. These are grouped by where enforcement happens, not by what the control is called.
| Control | Enforcement | Layer |
|---|---|---|
| Encryption in transit | TLS 1.2+ on every connection between you, the control plane, and the sandbox | All surfaces |
| Encryption at rest | AES-256 across the findings database and evidence storage | Storage |
| Credential storage | AES-256-GCM column-level encryption under a rotatable key held outside the database; ciphertext is all the control plane holds | Control plane |
| Credential use | Decrypted inside the sandbox at the moment of use, never logged, destroyed with the sandbox | Pentest sandbox |
| Source code | Cloned into memory for the duration of the pentest; never written to disk, never persisted | Pentest sandbox |
| Tenant isolation | A dedicated single-use sandbox per pentest — no shared file system, process, or memory | Pentest sandbox |
| Network egress | Deny by default. Private subnet with no internet gateway; all traffic forced through an allow-listed L7 proxy | Network |
| Environment scope | Staging and pre-production targets only — production is out of scope by design | Product |
| Model provider training | No inference provider trains on your code or findings — contractually, and with provider-side sharing disabled | Vendor agreements |
| Model provider retention | Prompts and responses are not stored for retrieval. Retention beyond the request varies by provider: zero for Baseten, up to 30 days of provider-side abuse monitoring for Anthropic and OpenAI | Vendor agreements |
| Access control | RBAC over scope configuration, findings visibility, and credential management | Control plane |
| Single sign-on | Available for enterprise accounts via your identity provider | Control plane |
| Audit logging | Admin actions and scope changes recorded and retained | Control plane |
The third parties that process customer data on Xora’s behalf, and what each one sees. We notify customers before adding a subprocessor that changes this list.
| Subprocessor | Purpose | Data processed |
|---|---|---|
| Amazon Web Services | Sandbox compute, secrets management, evidence storage | Pentest data in memory; encrypted evidence at rest |
| Neon | Managed Postgres for findings, reports, and account records | Findings, organisation metadata, encrypted credentials |
| Vercel | Hosting for the dashboard and marketing site | Request metadata |
| WorkOS | Authentication, SSO, and directory sync | User identity and session data |
| Anthropic | Model inference for analysis and exploit agents | Code and response excerpts during a pentest |
| OpenAI | Model inference for analysis and exploit agents | Code and response excerpts during a pentest |
| Baseten | Model inference for analysis and exploit agents | Code and response excerpts during a pentest |
| Langfuse | Cost and latency observability for model calls | Pentest metadata only — token counts, model IDs, timings. Prompt and response content never leaves our VPC. |
| Merge.dev | Ticketing integrations (Jira, Linear) | Finding summaries you choose to sync |
| Resend | Transactional and digest email | Email address, finding summaries |
| Marketing site analytics | Visitor IP and page activity on getxora.ai. No customer pentest data. |
No model provider we use trains on your code or findings — yours or anyone else’s. Provider-side sharing is disabled on every account, and we send the no-store flag on every request, so prompts and responses are not kept for retrieval. Baseten retains nothing at all; Anthropic and OpenAI keep a short-lived abuse-monitoring copy, up to 30 days, which we are working to remove. We would rather state that precisely than round it to zero.
| Framework | Status | Notes |
|---|---|---|
| SOC 2 Type II | Not yet attested | Readiness work is underway and we are selecting an audit partner. We will publish the observation window start date once it is set. |
| ISO 27001 | Roadmap | Planned following SOC 2 Type II completion. |
| GDPR | Aligned | The staging-only model limits personal data exposure. Data processing terms are agreed per contract. |
Ahead of formal attestation, our architecture — ephemeral execution, column-level credential encryption, staging-only scope, destroyed-on-exit sandboxes — is designed to satisfy the substance of the controls SOC 2 attests to.
Report a suspected issue to security@getxora.ai. We acknowledge within two business days. Read our coordinated disclosure policy.
Confirmed incidents affecting customer data are disclosed without undue delay, per your agreement with us.
Source code and sandbox state are never persisted beyond the pentest. Findings, evidence, and the execution log of the pentest remain in your account until you request deletion.
Nothing, because nothing was kept. Source is cloned into the sandbox's memory, analysed, and discarded when the sandbox is destroyed. It is never written to disk and never leaves the sandbox — what leaves the sandbox is the findings, their evidence, and the execution log of what the agents did.
No. The sandbox runs in a private subnet with no internet gateway, so there is no route to the internet for an agent to find. Its only egress path is a proxy that permits the hosts in your declared scope and denies everything else. This is enforced below the agent, so a confused or compromised agent cannot reason its way past it.
No. Xora connects only to staging and pre-production environments. That is a design decision, not a setting. It removes production outage risk entirely, and it is why the platform can attack aggressively enough to prove an exploit rather than just flag a pattern.
No, and neither do our model providers. Your code and findings are used only to carry out your pentests and produce your reports. Training is off contractually and provider-side: every sharing control is disabled on our accounts. Storage is a separate question and we answer it separately — we send the no-store flag on every request, so nothing is kept for retrieval, and Baseten retains nothing at all. Anthropic and OpenAI do keep a short-lived copy for abuse monitoring, up to 30 days, which we are working to remove. Nothing in either window is ever used as training data.
Access is governed by RBAC within your organisation. Xora personnel access customer findings only when you request support, and those actions are logged.
Staging is where that risk belongs, which is the point of the staging-only model. Pentests are scoped to the targets you declare, and every action an agent took is in the pentest's evidence trail, so anything that broke can be traced to the request that caused it.
Not yet. We have not completed an attestation, and the observation window a Type II report covers has not started. We would rather tell you that than imply otherwise. The white paper and a signed NDA for deeper technical review are available in the meantime, and we will say so here the moment that changes.
Customers can display the Continuous Pentesting badge on their own site. It shows that a company is enrolled in Xora’s continuous pentesting program, and the year they joined.
That is the whole claim. The badge does not report the findings of any individual test, and it does not say a site is free of vulnerabilities — no security program can honestly promise that. It says this company chose to be tested continuously rather than once a year, and has been since the year shown.
Verifying a specific company? Get in touch and we’ll confirm whether they’re a current customer.
The white paper covers everything on this page in a document your reviewers can file — architecture, controls, compliance status, and incident response.
Get our security whitepaperNeed an NDA for deeper technical review? security@getxora.ai