> ## Documentation Index
> Fetch the complete documentation index at: https://docs.xpander.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Security Architecture

> xpander operates both planes for you, with the same runtime controls as every deployment.

There is no customer cluster, PrivateLink endpoint or installer. You sign in at `chat.xpander.ai` and your agents run. The runtime controls are the same as in every deployment: see [Security Architecture](https://docs.xpander.ai/resources/security-compliance/security-architecture.md).

## Architecture

![Cloud architecture. Users and AI Engineers reach xpander Cloud over TLS. Inside, a control plane holds xpander Chat, identity with SSO, the agent registry, and the skills catalog; a data plane holds the execution tier, the agent-controller's skill relay (drawn as AI Gateway), PostgreSQL, and Redis with vectors, hosting threads, memory, and knowledge bases. Model calls go out to LLM providers and skill calls go out to the systems your skills reach. Captions state TLS at xpander's ingress, encryption at rest with cloud-provider managed keys, and that skill credentials are injected by the skill relay and never visible to the model.](https://mintcdn.com/xpanderai-099931d1/OdLxX9OyFVicAV0l/images/security/cloud-architecture.svg?fit=max\&auto=format\&n=OdLxX9OyFVicAV0l\&q=85\&s=18690aacb9868e3544bf9ab3bca7af31)

xpander cloud. xpander operates the control plane (xpander Chat, identity, agent registry, skills catalog) and the data plane (the execution tier, the agent-controller's skill relay, PostgreSQL, Redis). LLM providers and the systems your skills reach sit outside and are reached from the data plane.

| Part | What it is |
| - | - |
| **Users** | Reach `chat.xpander.ai` over TLS. Enterprise plans add [SSO over OIDC](https://docs.xpander.ai/resources/security-compliance/access-control.md#single-sign-on). |
| **Control plane** | xpander Chat, identity, the agent registry, the skills catalog and the deployment manager, operated by xpander |
| **Data plane** | The execution tier runs agents on Claude Code, Codex or OpenCode. The skill relay in `agent-controller` brokers skill calls. PostgreSQL and Redis hold threads, memory and knowledge bases. Operated by xpander. |
| **Your systems** | The LLM provider accounts you configure and the APIs your skills reach. Model calls go through the [LLM Gateway](https://docs.xpander.ai/run/llm-gateway.md). Skill credentials are injected at call time and never reach the model. |

The `deployment_type` field in the [List Agents](https://docs.xpander.ai/api-reference/v1/agents/list-agents.md) API still reads `serverless`.

## Identity and access

[RBAC](https://docs.xpander.ai/resources/security-compliance/access-control.md) governs who may build, deploy and use agents. API keys are scoped and revocable. Audit logs record skill calls, data access and configuration changes ([the record](https://docs.xpander.ai/resources/security-compliance/access-control.md#the-record)). Every control on [Govern](https://docs.xpander.ai/run/govern.md) lives in xpander Chat.

## Encryption and data handling

| Topic | What applies |
| - | - |
| Encryption | TLS terminated at xpander's ingress. Data at rest encrypted with cloud-provider managed keys. |
| GDPR roles | For Managed Runtime (Cloud) workloads, xpander is the **data processor** and you are the controller. A DPA comes with enterprise contracts. See [GDPR](https://docs.xpander.ai/resources/security-compliance/certifications-compliance.md#gdpr). |
| Region | A region-specific deployment can be requested. |
| Erasure and portability | Conversation history, knowledge-base documents and user memories can be deleted on request. Agent configurations and task history can be exported, through the API and xpander Chat. |

xpander.ai is **SOC 2 Type II** certified (Security, Availability, Confidentiality), with the report under NDA. ISO 27001, HIPAA and FedRAMP are in progress. See [Certifications & Compliance](https://docs.xpander.ai/resources/security-compliance/certifications-compliance.md).

## Next steps

Need data residency in your own network, or zero egress to xpander? Use a self-hosted deployment.

> **[Hybrid Architecture](https://docs.xpander.ai/resources/security-compliance/security-architecture-hybrid.md)**
>
> Data plane in your VPC

> **[Air-Gapped Architecture](https://docs.xpander.ai/resources/security-compliance/air-gapped-deployments.md)**
>
> Zero egress to xpander

> **[Review the runtime controls](https://docs.xpander.ai/resources/security-compliance/security-architecture.md)**
>
> Permissions, credentials, safety

> **[Request compliance documents](https://docs.xpander.ai/resources/security-compliance/certifications-compliance.md)**
>
> SOC 2, GDPR


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.