Trust as a live posture,
not a PDF.
This page is the operator memory: the current month's posture, the last quarter's incidents, and the next audit dates — kept fresh by the same control plane your auditors will read.
Status feed, incident history, vulnerability disclosure policy, sub-processor list, and the personnel-access controls that decide who at exAI can ever touch your data. Numbers are real. Dates are current. Subscribe and the next advisory lands in your inbox before the patch ships.
Six surfaces.
One honest board.
The same probes that page our SREs power this board. We do not edit the green. Degraded surfaces stay yellow until the postmortem closes — not until the marketing team feels comfortable.
Last quarter, in
receipts.
Every incident with customer-facing impact lands here within 72 hours of resolution. Postmortems are public, not paywalled. We name root causes, not symptoms; we name dates, not weeks-ago handwaving.
Composer router timeout in eu-west-1
Root cause · Upstream model provider failure cascaded to router queue.
SCIM webhook delivery delayed
Root cause · Queue backpressure from a single tenant’s burst sync.
Prebuild cache eviction in us-east-1
Root cause · Disk pressure on cache tier · LRU eviction window opened.
Audit log Splunk lag
Root cause · Downstream Splunk HEC backpressure · streaming-only path.
Coordinated.
Paid. Public.
Researchers are partners, not threats. We operate a published disclosure program with tiered bounties, safe-harbor language aligned with industry norms, and a public CVE history that names every issue we shipped a fix for.
exAI runs a coordinated-disclosure program. Researchers who report in good faith receive safe harbor under our policy: no legal action, no contract enforcement, no platform throttling. We acknowledge inside one business day, scope inside three, and patch inside the agreed disclosure window — typically 90 days, faster for in-the-wild issues.
The full policy, scope boundaries, and out-of-scope list are published at security.exai.dev/disclosure. Reports go to security@exai.dev encrypted under the PGP key below — or via HackerOne for researchers who prefer that channel.
- ●90-day disclosure windowCoordinated disclosure timeline aligned with industry norms. We commit to a fix or a documented mitigation before public disclosure.
- ●Bounty tiers · $50k → $500Critical · $50,000. High · $25,000. Medium · $5,000. Low · $500. Paid on verified report; no NDA required.
- ●Hall of fame · 41 researchersPublic credit on first valid report. Researchers retain the right to publish their findings after the disclosure window closes.
- ●PGP · F4D2 8C19 7A3B 11E0security@exai.dev · key-id F4D2 8C19 7A3B 11E0 · key.exai.dev/security.asc · rotated annually.
- CVE-2026-04812● Mediumcomposer/router-policy2026-04-02 · fixed v2026.04.1
- CVE-2026-03991● Highworkspace/firecracker-bridge2026-03-15 · fixed v2026.03.2
- CVE-2026-02788● Mediumapi/scim-webhook2026-02-21 · fixed v2026.02.3
- CVE-2026-01433● Lowbuilder/preview-proxy2026-01-09 · fixed v2026.01.1
- CVE-2025-12044● Highorchestrator/checkpoint-store2025-12-19 · fixed v2025.12.4
- CVE-2025-11876● Mediumaudit/iceberg-relay2025-11-30 · fixed v2025.11.2
Who can touch it.
Where it lives.
The full vendor list, the purpose, the region, and the DPA status. Plus the four personnel groups at exAI that can ever hold a token against your tenant — and the audit replication that makes every one of their actions visible to you.
- Engineering
No standing access. Break-glass requires a paged ticket, a second engineer’s approval, and writes a customer-visible audit event in real time.
- Support
Scoped to the ticket’s tenant and the ticket’s minimum data class. Tokens auto-revoke 24h from grant or on ticket close — whichever is sooner.
- ML researchers
ML researchers have no production access. Training corpora are synthetic or licensed. No customer prompts, no customer outputs, ever, on any tier.
- Operations
Every operations action — config push, schema migration, KMS rotation — replicates to your SIEM in under one second with the original actor identity.
We keep the receipts.
So your auditors are kept happy.
Subscribe to security advisories and you will hear about the next CVE before the patch ships. Request a briefing and a Fortune-100-grade compliance package — controls matrix, pen test summary, latest audit response — lands in your secure inbox under NDA inside one business day.