Trust Center
Security built in. Evidence collected. Controls verified.
X.R.A.Y. is built to enterprise security standards for veteran-owned and commercial businesses that operate in regulated environments and federal contracting. This page is evidence, not copy — every claim links to the control it represents.
Compliance Posture
SOC 2 observation window open. No certifications claimed before held.
X.R.A.Y. controls are implemented and operating. Evidence collection for SOC 2 Type II began September 1, 2026. A formal auditor engagement is in progress. Results will be shared with customers when available.
SOC 2 Type II
Controls implemented and operating since September 1, 2026. Independent auditor engagement in progress.
NIST SP 800-53
Infrastructure mapped to NIST 800-53 moderate baseline. FedRAMP Moderate ATO is a 2027 milestone.
WCAG 2.2 AA
8.5:1 body-copy contrast. Focus-visible on every interactive element. Checked each sprint.
OWASP LLM Top 10
Prompt injection guardrails, output validation, rate limits, ARCEB logging on all LLM paths.
GDPR + CCPA
Data subject rights enforced. DPA available on request. One-click export. Deletion within 30 days.
Security Architecture
Security built in. Not bolted on.
Every architectural layer enforces isolation and encryption as hard constraints. Authentication and tenant scoping happen before any data is touched.
Tenant Isolation
Row-Level Security on every table. Tenant A cannot read or detect Tenant B's records. Structural — not middleware.
Encryption at Rest
AES-256 across all storage layers. Database, file storage, and backups encrypted before they touch disk. Keys managed separately.
Encryption in Transit
TLS 1.2+ on all connections. Browser to CDN, CDN to API, API to database, API to every downstream service.
Secrets Management
No credentials exist in application code or environment files. All secrets injected at runtime from AWS Secrets Manager.
Least-Privilege Access
Every internal service has credentials scoped to exactly what it requires. No standing access to unused resources.
Multi-Factor Auth
All administrative access to production systems requires MFA. Session tokens carry minimum required scope.
Data Residency
US-only. AWS us-east-1.
Primary Region
AWS us-east-1 (Northern Virginia)
All production compute, database, cache, and storage.
Secondary Region
Not active
DR architecture specification in preparation. No cross-region replication active.
Database
Amazon RDS PostgreSQL 16 — Multi-AZ
Encrypted at rest. Automated backups with 7-day retention.
Cache
Amazon ElastiCache Serverless (Valkey)
TLS-only. No persistent sensitive data.
Object Storage
Amazon S3 — us-east-1
Server-side encryption. Access restricted to service accounts.
Secrets
AWS Secrets Manager — us-east-1
No secrets in environment variables or application code.
Audit Logging — ARCEB
Every action logged. Immutable. Seven years.
The Audit Record and Compliance Evidence Base (ARCEB) captures every agent action, login event, data operation, and compliance decision with a timestamped record that no process, operator, or platform update can modify or delete.
Append-Only Records
Audit rows can never be changed or removed once written. A database trigger enforces this, not access policy alone.
Seven-Year Retention
Required for federal contracting (FAR) and tax compliance. Every record accessible for the full retention window.
Every Agent Action
AI agent decisions, inputs, and outputs are logged before the result is presented to any user. No action without a record.
Export on Demand
Your full audit history can be exported at any time in structured format suitable for compliance submissions or audits.
AI Governance
XAS-1 — X.R.A.Y. Autonomy Standard
Every AI agent on X.R.A.Y. operates under XAS-1, the platform's binding autonomy standard. Customers can inspect, pause, and quarantine any agent in their account within 5 minutes through the Agent Registry.
Reversibility Classification
Every agent action is classified as reversible or irreversible before execution. Unclassified defaults to irreversible — requiring consent.
No Impact Without Evidence
No claim of agent impact is made without machine-verified telemetry. Assertions without data are prohibited.
Veteran Safety Hard-Exempted
LIFELINE and VSTAGP navigate-tier flows are hardcoded exempt from autonomous commit. Not configurable. Not overridable.
Customer Kill Switch
Pause or quarantine any agent, or withdraw its adapter scopes, from the Agent Registry. Mode I downgrade pauses all autonomous actions tenant-wide.
ARCEB on Every Decision
Consensus path (proposal → verification → policy gate → commit) is fully logged before the result is shown.
Model Watch — 60-Day Lag
New model adoption lags provider release by 60 days and requires CEO approval. Verified beats current.
Subprocessors
Every vendor. Generated from the adapter registry.
This list is generated from the X.R.A.Y. Integration Hub (XIH) adapter registry — the same registry that enforces the Adapter Mandate at runtime (LD-276 Rule 1). A vendor not listed here has no path to customer data.
| Vendor | Category | Purpose | Data Access | Location |
|---|---|---|---|---|
| Anthropic PBC | AI / LLM | Language model inference (LD-287 model lock) | Content (encrypted in transit) | US |
| Deepgram Inc. | Voice / STT | Speech-to-text transcription | Content (encrypted in transit) | US |
| ElevenLabs Inc. | Voice / TTS | Text-to-speech synthesis | Content (encrypted in transit) | US |
| Stripe Inc. | Payments | Payment processing and billing | Metadata only | US |
| Twilio Inc. | Telephony / SMS | Phone provisioning, SMS, inbound webhooks | Metadata only | US |
| Resend Inc. | Transactional Email | Transactional email delivery | Content (encrypted in transit) | US |
| Amazon Web Services | Cloud Infrastructure | Compute (ECS Fargate), database (RDS PG 16), cache (Valkey), secrets, object storage — us-east-1 | Content (encrypted in transit) | US (us-east-1) |
| Syncfusion Inc. (BoldSign) | E-Signature | Electronic signature workflows | Content (encrypted in transit) | US |
| CorpNet Inc. | Business Formation | LLC and corporation registration | PII (encrypted in transit, contractually protected) | US |
| Dun & Bradstreet | Business Credit | Business credit profile retrieval via SCORIVA | Metadata only | US |
| U.S. GSA (SAM.gov) | Government Data | Federal contractor and VOSB/SDVOSB status (public API) | No customer data transmitted | US |
| U.S. Treasury (USASpending) | Government Data | Federal award and spending data (public API) | No customer data transmitted | US |
| V.E.R.I.F.Y.™ (native) | Identity Verification | Veteran and citizen identity verification (PAT-118) | PII (encrypted in transit, contractually protected) | US |
Incident Response
24-hour acknowledgement. Clear communication. No surprises.
X.R.A.Y. maintains documented incident response procedures covering detection, containment, eradication, recovery, and post-incident review. All procedures are trained on quarterly.
- Affected customers notified within 72 hours of confirmed breach
- Post-incident report published within 30 days
- Status page reflects all ongoing incidents in real time
Vulnerability Disclosure
Report a security issue.
If you discover a security vulnerability in X.R.A.Y. products or infrastructure, please report it to us. We acknowledge receipt within 24 hours and commit to a first response within 5 business days. We do not pursue legal action against good-faith researchers.
security@25xray.aiInclude: description, reproduction steps, affected URL or component, and your contact information.
Common Questions
Security questions, answered directly.
- Where does X.R.A.Y. stand on SOC 2?
- Not yet. X.R.A.Y. is built to SOC 2 Type II Trust Services Criteria and has been in active evidence collection since September 1, 2026. An independent auditor engagement is in progress. We will communicate the audit outcome when it is complete and will not claim a certification before it is held.
- Where is my data stored?
- All X.R.A.Y. production data is stored in AWS us-east-1 (Northern Virginia). No data is replicated to any other AWS region without explicit customer instruction. Disaster recovery architecture specifications are in preparation.
- Is my business data shared with other businesses on X.R.A.Y.?
- No. Row-Level Security is enforced on every database table. Tenant A cannot read, write, or detect the existence of Tenant B's records. This is an architectural constraint — not a policy agreement.
- How long are audit logs retained?
- All audit records are retained for seven years under the ARCEB (Audit Record and Compliance Evidence Base) standard. Records are append-only — no one can change or remove them, including platform operators.
- What encryption does X.R.A.Y. use?
- AES-256 encryption is applied to all data at rest including database volumes, file storage, and backups. All data in transit uses TLS 1.2 or higher. No plaintext transport is permitted in any environment.
- How does X.R.A.Y. govern AI agents?
- X.R.A.Y. operates under XAS-1 (X.R.A.Y. Autonomy Standard v1.0), which classifies every agent action as reversible or irreversible before execution, requires machine-verified telemetry before any impact claim, and hard-exempts veteran-safety flows from autonomous commit. Every agent decision carries a plain-language explanation and reversal window. The full XAS-1 working paper is available at /trust/xas1.
- How do I report a security vulnerability?
- Email security@25xray.ai with a description of the vulnerability, reproduction steps, and your contact information. We acknowledge receipt within 24 hours and commit to a first response within 5 business days. We do not pursue legal action against good-faith security researchers.
- Can I request compliance documentation such as a DPA or security questionnaire response?
- Yes. Use the Document Request form on this page to request a Data Processing Agreement (DPA), security overview, vendor questionnaire response, subprocessor list, or SOC 2 readiness documentation. Our security team responds within 2 business days.
Document Request
Request compliance documentation.
NDA-gated documents are reviewed and delivered by our security team within 2 business days. Provide your organization details and the document type needed.