Certifications & Compliance

What is certified, what is in progress, and how your deployment choice helps meet compliance.

xpander.ai is SOC 2 Type II certified. ISO 27001, HIPAA and FedRAMP are in progress. Until they are certified, a Hybrid or Air-gapped deployment brings agents under your existing compliance program. The controls behind all deployments are on Security Architecture, and the cloud deployment on Cloud.

Certification status

Standard	Status	Documentation
SOC 2 Type II	Certified	Report under NDA
GDPR	Compliant	DPA with enterprise contracts
ISO 27001	In progress	Contact us for state and timeline
HIPAA	In progress	BAA on request for eligible deployments
FedRAMP	In progress	Contact us if a federal deployment is planned

SOC 2 Type II

The audit covers Security, Availability and Confidentiality, evaluated over a period of time, not on a single date. It covers logical and physical access, encryption in transit and at rest, change management, incident response, backup and disaster recovery, and vendor management. Request the SOC 2 report.

GDPR

Topic	What applies
Data residency	On Hybrid or Air-gapped, runtime data (task execution, memory, knowledge bases, audit logs) stays in your region. Hybrid also syncs agent definitions, the skills catalog and heartbeats with xpander Cloud (what leaves). On xpander Cloud, a region-specific deployment can be requested.
Erasure and portability	Conversation history, knowledge-base documents and user memories can be deleted on request. Agent configurations and task history can be exported in standard formats, through the API and xpander Chat.
Managed Runtime (xpander Cloud)	You are the controller. xpander is the data processor.
Unmanaged Runtime with your own AI provider and private skills	You are the controller. xpander’s privacy policy does not extend to those processing activities.

Details: Privacy Policy. DPAs and sub-processor lists come with enterprise contracts.

HIPAA, ISO 27001, FedRAMP

Standard	Where it stands
HIPAA	PHI controls (encryption at rest and in transit, audit logging of all data access, customer data isolation) are in place under SOC 2. Formal attestation and the BAA program are in progress. To keep PHI in your infrastructure, ask about BAA availability with Hybrid or Air-Gapped.
ISO 27001	Most control families overlap with SOC 2 Type II. Certification in progress.
FedRAMP	Federal customers deploy Hybrid or Air-gapped under their existing Authority to Operate (ATO), keeping data in infrastructure the ATO covers.

Deployment patterns by industry

Industry	Typical deployment	Why
Financial services	Hybrid	Data residency, per-agent audit log, RBAC for segregation of duties
Healthcare	Hybrid or Air-Gapped	PHI stays in your environment, encryption at rest, scoped BAA
Government and defense	Air-Gapped	Full data sovereignty, no dependency on xpander’s cloud
Critical infrastructure	Hybrid with PrivateLink	Outbound-only sync stays on the AWS private backbone

Documents you can request

SOC 2 Type II report and penetration testing summary (under NDA), Data Processing Agreement (enterprise contracts), sub-processor list, HIPAA BAA (eligible deployments) and the architecture and security whitepaper, all on request. The Privacy Policy and Terms of Service are public. Contact our team with what your review needs. An NDA comes before sensitive documents.

Next steps

Review the runtime controls

Permissions, credentials, safety

Request compliance documents

Reports, DPA, BAA