Security & Compliance
Designed to support customer technical controls and audit evidence under EU AI Act Article 14 (Effective Human Oversight), SOC 2 Type II, HIPAA, and GDPR. Exogram provides deterministic enforcement and tamper-evident audit trails.
Cryptographic Merkle Proofs vs. Storage Immutability
Exogram separates mathematical verification from physical storage mechanics. We distinguish between:
Tamper-Evident Cryptographic Merkle Proofs
Every execution decision generates an SHA-256 HMAC state hash anchored in a verifiable Merkle tree. Any alteration, insertion, or deletion in the historical record mathematically invalidates downstream hashes, making unauthorized record modification immediately detectable.
Storage Immutability
Storage immutability governs physical retention rules (WORM storage, object locks, or append-only database configurations). While storage layers prevent accidental deletion, Exogram's cryptographic Merkle proofs ensure data integrity even against privileged database administrators.
Deployment Architectures
Exogram is designed to adapt to rigorous enterprise isolation models and data sovereignty requirements:
Multi-Tenant SaaS
Fully managed Authority Runtime hosted across SOC 2 Type II certified AWS and Cloudflare infrastructure. Logical tenant isolation, AES-256-GCM encryption, and regional data residency in US and EU zones.
Dedicated VPC
Single-tenant runtime provisioned in a dedicated customer cloud perimeter. Private VPC peering, AWS PrivateLink, dedicated cryptographic keys, and customer-managed encryption (CMEK).
Air-Gapped / Sidecar
Self-hosted sidecar binary or Docker container deployed directly within private Kubernetes clusters, on-premises datacenters, or SCIFs. 100% local policy evaluation with zero outbound telemetry.
Data Flow Boundaries: Metadata vs. Enterprise Payloads
Exogram evaluates metadata and schemas; customer enterprise data stays in customer VPC.
- ✔What Exogram Evaluates: Function call signatures, parameter schemas, state transition invariants, rate limit windows, and cryptographic capability tokens.
- ✔What Remains in Customer VPC: Raw database tables, application payload bodies, confidential prompt context, embeddings, and sensitive PII.
- ✔Zero Model Training: Customer telemetry is never used for training or fine-tuning foundation models.
Technical Controls & Infrastructure Hardening
UUID-Hardened Identity Boundary
Every API endpoint enforces strict UUID v4 validation at the request boundary. Malformed identifiers, string-based user IDs, and injection attempts are rejected before reaching any database query. This prevents identity spoofing and cascading error loops.
Encryption in Transit & at Rest
All telemetry and ledger state data is encrypted at rest using AES-256-GCM and in transit via TLS 1.3. Continuous automated vulnerability scanning and threat detection monitor execution pathways.
Vulnerability Reporting & Disclosure
We treat security reports with urgency. If you discover a potential vulnerability in the Exogram platform or MCP adapter, please contact our security team at security[at]exogram.ai. We acknowledge receipt within 24 hours.