Security as a primitive,
not a feature.
exAI runs every workspace in its own Firecracker microVM, encrypts every artefact under a key you control, and streams every action to your SIEM in under a second.
This page is the operator memory: the isolation model, the secret-handling pipeline, the audit log targets, the certifications we hold today, and the deployment shapes — managed cloud, private cloud, air-gapped — that we ship against. No marketing. Real numbers, real control planes.
One workspace.
One microVM. Always.
Every workspace boots inside its own Firecracker microVM under KVM. Tenants never share a kernel. Network paths are per-tenant: every microVM has its own veth, its own egress allowlist, and its own rotating disk-encryption key. The control plane never reaches inside a workspace — it only schedules them.
exAI does not run untrusted code in containers. Containers share the host kernel — that surface is too wide for the threat model. Instead, every workspace, every long-running agent task, and every Builder preview boots inside a Firecracker microVM. Boot is 125 ms cold, snapshot resume is 612 ms, and the per-VM kernel is a hardened, minimal Linux with no SSH and no inbound surface.
Networking is built the same way. Each microVM gets a per-tenant veth pair landed in a tenant-scoped network namespace. Egress is enforced by an eBPF program loaded into the host: default-deny, with allowlists derived from the tenant's policy bundle. Inter-workspace traffic is impossible without an explicit, signed policy approval.
Disks are encrypted per-VM with AES-256-XTS, keyed off the tenant data-encryption key (DEK), which itself is wrapped by a customer-managed KEK in your KMS. When a workspace is destroyed, its image, snapshot, and key material are shredded inside the same minute.
- 01 · vCPU floor1 vCPU per workspace, hard floorNo pinning to noisy neighbors. cgroups v2 + cpuset enforcement.
- 02 · KVM-isolatedOne microVM per tenant workspaceFirecracker over KVM. No shared kernel, no shared user namespace.
- 03 · Snapshot-resumeResume in 612 ms · cold start 4.1 sPer-workspace memory snapshot on idle, restored from disk on hit.
- 04 · eBPF egress filterPer-VM allowlist, default-denyNo outbound to public IPs unless declared in workspace policy.
- 05 · Rotating per-VM image keysAES-256-XTS, key per microVM lifetimeImage keys derived from tenant DEK; rotated on snapshot, never reused.
Nothing leaks.
Everything is witnessed.
Four layers between a prompt and your SIEM. Pre-prompt scrubbing for sensitive inputs. Customer-managed KEKs for everything stored. An immutable audit log streamed to the tools your SOC already uses. Retention policies that match regulated workloads — not a vendor's preference.
Every prompt and every tool input passes a two-stage scrubber. Stage 1 is a deterministic regex pack (AWS keys, GCP service accounts, GitHub PATs, JWTs, RFC-822 emails, IBANs). Stage 2 is a small classifier trained on internal labelled corpora to catch shaped-but-novel secrets and PII.
scrub.detect → match=AWS_ACCESS_KEY_ID scrub.replace → ‹AKIA****REDACTED***›
Each tenant has its own key encryption key (KEK), held in your KMS — not ours. exAI never holds plaintext key material; we hold a wrapped DEK that only your KEK can decrypt. Rotate the KEK and every workspace re-keys on next boot. Pull the KEK and the tenant goes opaque in 30 seconds.
kms.encrypt(arn:aws:kms:eu-west-1:.../tenant-abc-kek) → ciphertext.dek = AQID***wrapped***
Every action — workspace boot, agent step, file read, KMS unwrap, IdP claim — becomes a structured event. Events stream to your SIEM over a customer-pull or push connector. We also write to an immutable S3-Iceberg log with hash-chained manifests, so your auditor can independently verify any claim.
{ts:1746...,actor:'k.mori',action:'agent.exec',
target:'TestWriter',workspace:'wks-prod-01'}Prompts and tool inputs are not retained for training — ever, on any tier, by any operator. The transient store is purged inside 24 hours. The audit log is the opposite — it is retained for 7 years (configurable upward to 10), encrypted at rest, with quarterly key rotation and verifiable deletion.
retention.policy = {prompts:0d, audit:2557d, replay:30d}The paperwork your auditor
actually asks for.
Reports, attestations, and BAAs available under NDA via the Trust Center. Each certificate ships with a controls matrix, penetration test summary, and the most recent audit management response. FedRAMP Moderate is in 3PAO assessment with target authorization Q3 2026.
Run it in your perimeter.
Or run it offline. Both ship.
Three deployment shapes, one product. Pick the one that matches your regulator, your network, and your procurement. Each ships from the same Helm chart, audited the same way, supported by the same SRE rotation — no second-class installations.
Private cloud
Single-tenant control plane in your VPC, GPU-backed compute on AWS Outposts, GCP Distributed Cloud Edge, Azure Local, or HPE GreenLake. Your network, your IdP, your KMS — exAI runs as a managed workload inside the perimeter.
- Banking
- Healthcare
- Defense-adjacent
- Energy
- Telecom
- Public
Air-gapped
Full offline install. Helm chart on Kubernetes 1.29+, signed model bundles delivered on encrypted media, a local mirror for telemetry, and a one-binary update channel. No phone-home, no implicit egress, no exceptions. Tested against airgap-verifier in CI.
- Defense-adjacent
- Banking
- Energy
- Public
- Telecom
- Healthcare
Customer-managed everything
DNS, KMS, identity, models, telemetry — all customer-owned. Bring your own Anthropic, OpenAI, Mistral, or self-hosted Llama / Qwen endpoints. exAI is the runtime; the keys, the models, and the data planes are yours. Runbook included.
- Banking
- Healthcare
- Defense-adjacent
- Energy
- Telecom
- Public
Bring it into your perimeter.
Or leave it at the edge.
We ship the same product into managed cloud, your private cloud, and air-gapped sovereign sites. The control plane is the same. The audit log is the same. The certifications are the same. The only thing that changes is who owns the keys — and that's a choice you make, not a tier we sell.