'%3E%3Cpath fill='%23F3E7DB' fill-rule='evenodd' d='M120 57H37V61Q37 76 57 76H76Q87 76 92 68H119Q113 100 79 100H41Q0 100 0 61V39Q0 0 41 0H79Q120 0 120 39ZM38 37H82V33Q82 25 74 25H46Q38 25 38 33Z'/%3E%3Cg transform='translate(128)'%3E%3Cpath fill='%23E86A0A' d='M5 0H39Q42 0 45 3L61 17Q64 20 64 23V26L52 40Q50 43 47 43H37Q34 43 31 41L3 20Q0 18 0 15V5Q0 0 5 0Z M135 0H101Q98 0 95 3L79 17Q76 20 76 23V26L88 40Q90 43 93 43H103Q106 43 109 41L137 20Q140 18 140 15V5Q140 0 135 0Z M4 80L31 59Q34 57 37 57H47Q50 57 52 60L58 68H82L88 60Q90 57 93 57H103Q106 57 109 59L136 80Q140 83 140 87V95Q140 100 135 100H102Q99 100 96 98L81 85H59L44 98Q41 100 38 100H5Q0 100 0 95V87Q0 83 4 80Z'/%3E%3Crect x='58' y='35' width='24' height='26' rx='3' fill='%233F5BE8'/%3E%3C/g%3E%3Cpath transform='translate(276)' fill='%23F3E7DB' fill-rule='evenodd' d='M43 0H77Q120 0 120 40V60Q120 100 77 100H43Q0 100 0 60V40Q0 0 43 0ZM49 31Q43 31 43 37V63Q43 69 49 69H71Q77 69 77 63V37Q77 31 71 31Z'/%3E%3C/g%3E%3C/svg%3E)
Trust
Trust at Exo
AI is already working inside your company through the back door. Exo brings it in through the front: every action recorded, every agent bounded, and a person deciding what matters.
Your data stays yours.
You own it. We process it only on your instructions, under a data processing agreement we sign with you, and we return or delete it within 30 days when we part ways. Leads we build for you are yours too, and they never mix with another client’s.
Sealed per client.
Every client has its own sealed space in our database (enforced by the database itself, not only by our code), its own credentials and its own opt-out list. Production runs in Germany. There is no public admin access: the servers accept administration only over a private network.
Agents with limits.
Each agent has a written role: what it may read, what it may write, and what it must never do. Anything that leaves your company or can’t be undone waits for a human. Text from emails, tickets and web pages reaches an agent marked as data, never as instructions. A kill switch stops every agent of a client at once.
A record you can check.
Every agent action goes into a work log that can’t be edited after the fact. Ask, and we export your company’s log for you.
Your data doesn’t train models.
We use AI models through commercial API terms that bar training on customer data.
When something goes wrong.
We tell you within 24 hours of finding out, with what happened and what we’re doing about it.
Built to the standard.
Exo follows the Israeli Privacy Protection Law and its data security regulations, designs to the GDPR, and runs its controls to ISO 27001, ISO 27701 and ISO 42001. We plan to certify in 2027.
Sub-processors
Sub-processors
Providers that may process client data on our behalf. We give clients 30 days’ notice before adding one.
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of the platform and its database | Germany |
| Anthropic, PBC | AI models behind the agents | United States |
| TypeSafe | Fast structured judgments inside tasks | On request |
| Cloudflare, Inc. | Encrypted backups; secure access gateway | Global |
| Google LLC | Email, calendar and documents | Global |
| Tailscale Inc. | Private network for administration | United States |
AI principles
AI principles
- People decide. Agents prepare, draft and act within a written role; consequential actions wait for a human.
- No hidden AI. When an agent talks to a person on its own, it says it’s an AI.
- No decisions about people’s livelihoods. Exo doesn’t decide hiring, firing, performance or credit.
- Nothing unrecorded. Every action is logged and attributable.
- Least data. Agents get only what the task needs.
Security
Reporting a security issue
Found a vulnerability? Email security@exo.partners with the details. We acknowledge within 2 business days, keep you informed, and won’t take legal action against good-faith research that avoids privacy harm and service disruption.
Documents: Privacy notice. Security overview, DPA and our answers to security questionnaires are available on request.
Questions, a security questionnaire, or a concern about how our AI behaved: privacy@exo.partners
security.txt
Contact: mailto:security@exo.partners Expires: 2027-10-05T00:00:00.000Z Preferred-Languages: en, he Policy: https://exo.partners/trust#security Canonical: https://exo.partners/.well-known/security.txt