Where does X.R.A.Y. stand on SOC 2?

Not yet. X.R.A.Y. is built to SOC 2 Type II Trust Services Criteria and has been in active evidence collection since September 1, 2026. An independent auditor engagement is in progress. We will communicate the audit outcome when it is complete and will not claim a certification before it is held.

Where is my data stored?

All X.R.A.Y. production data is stored in AWS us-east-1 (Northern Virginia). No data is replicated to any other AWS region without explicit customer instruction. Disaster recovery architecture specifications are in preparation.

Is my business data shared with other businesses on X.R.A.Y.?

No. Row-Level Security is enforced on every database table. Tenant A cannot read, write, or detect the existence of Tenant B's records. This is an architectural constraint — not a policy agreement.

How long are audit logs retained?

All audit records are retained for seven years under the ARCEB (Audit Record and Compliance Evidence Base) standard. Records are append-only — no one can change or remove them, including platform operators.

What encryption does X.R.A.Y. use?

AES-256 encryption is applied to all data at rest including database volumes, file storage, and backups. All data in transit uses TLS 1.2 or higher. No plaintext transport is permitted in any environment.

How does X.R.A.Y. govern AI agents?

X.R.A.Y. operates under XAS-1 (X.R.A.Y. Autonomy Standard v1.0), which classifies every agent action as reversible or irreversible before execution, requires machine-verified telemetry before any impact claim, and hard-exempts veteran-safety flows from autonomous commit. Every agent decision carries a plain-language explanation and reversal window. The full XAS-1 working paper is available at /trust/xas1.

How do I report a security vulnerability?

Email security@25xray.ai with a description of the vulnerability, reproduction steps, and your contact information. We acknowledge receipt within 24 hours and commit to a first response within 5 business days. We do not pursue legal action against good-faith security researchers.

Can I request compliance documentation such as a DPA or security questionnaire response?

Yes. Use the Document Request form on this page to request a Data Processing Agreement (DPA), security overview, vendor questionnaire response, subprocessor list, or SOC 2 readiness documentation. Our security team responds within 2 business days.

Trust Center

Security built in. Evidence collected. Controls verified.

X.R.A.Y. is built to enterprise security standards for veteran-owned and commercial businesses that operate in regulated environments and federal contracting. This page is evidence, not copy — every claim links to the control it represents.

Compliance Posture Request Documentation security@25xray.ai →

Compliance Posture

SOC 2 observation window open. No certifications claimed before held.

X.R.A.Y. controls are implemented and operating. Evidence collection for SOC 2 Type II began September 1, 2026. A formal auditor engagement is in progress. Results will be shared with customers when available.

Evidence Collection Active

SOC 2 Type II

Controls implemented and operating since September 1, 2026. Independent auditor engagement in progress.

Control Alignment

NIST SP 800-53

Infrastructure mapped to NIST 800-53 moderate baseline. FedRAMP Moderate ATO is a 2027 milestone.

Enforced in Production

WCAG 2.2 AA

8.5:1 body-copy contrast. Focus-visible on every interactive element. Checked each sprint.

Mitigations Active

OWASP LLM Top 10

Prompt injection guardrails, output validation, rate limits, ARCEB logging on all LLM paths.

Controls Active

GDPR + CCPA

Data subject rights enforced. DPA available on request. One-click export. Deletion within 30 days.

Security Architecture

Security built in. Not bolted on.

Every architectural layer enforces isolation and encryption as hard constraints. Authentication and tenant scoping happen before any data is touched.

Tenant Isolation

Row-Level Security on every table. Tenant A cannot read or detect Tenant B's records. Structural — not middleware.

Encryption at Rest

AES-256 across all storage layers. Database, file storage, and backups encrypted before they touch disk. Keys managed separately.

Encryption in Transit

TLS 1.2+ on all connections. Browser to CDN, CDN to API, API to database, API to every downstream service.

Secrets Management

No credentials exist in application code or environment files. All secrets injected at runtime from AWS Secrets Manager.

Least-Privilege Access

Every internal service has credentials scoped to exactly what it requires. No standing access to unused resources.

Multi-Factor Auth

All administrative access to production systems requires MFA. Session tokens carry minimum required scope.

Data Residency

US-only. AWS us-east-1.

Primary Region

AWS us-east-1 (Northern Virginia)

All production compute, database, cache, and storage.

Secondary Region

Not active

DR architecture specification in preparation. No cross-region replication active.

Database

Amazon RDS PostgreSQL 16 — Multi-AZ

Encrypted at rest. Automated backups with 7-day retention.

Cache

Amazon ElastiCache Serverless (Valkey)

TLS-only. No persistent sensitive data.

Object Storage

Amazon S3 — us-east-1

Server-side encryption. Access restricted to service accounts.

Secrets

AWS Secrets Manager — us-east-1

No secrets in environment variables or application code.

Audit Logging — ARCEB

Every action logged. Immutable. Seven years.

The Audit Record and Compliance Evidence Base (ARCEB) captures every agent action, login event, data operation, and compliance decision with a timestamped record that no process, operator, or platform update can modify or delete.

Append-Only Records

Audit rows can never be changed or removed once written. A database trigger enforces this, not access policy alone.

Seven-Year Retention

Required for federal contracting (FAR) and tax compliance. Every record accessible for the full retention window.

Every Agent Action

AI agent decisions, inputs, and outputs are logged before the result is presented to any user. No action without a record.

Export on Demand

Your full audit history can be exported at any time in structured format suitable for compliance submissions or audits.

AI Governance

XAS-1 — X.R.A.Y. Autonomy Standard

Every AI agent on X.R.A.Y. operates under XAS-1, the platform's binding autonomy standard. Customers can inspect, pause, and quarantine any agent in their account within 5 minutes through the Agent Registry.

Reversibility Classification

Every agent action is classified as reversible or irreversible before execution. Unclassified defaults to irreversible — requiring consent.

No Impact Without Evidence

No claim of agent impact is made without machine-verified telemetry. Assertions without data are prohibited.

Veteran Safety Hard-Exempted

LIFELINE and VSTAGP navigate-tier flows are hardcoded exempt from autonomous commit. Not configurable. Not overridable.

Customer Kill Switch

Pause or quarantine any agent, or withdraw its adapter scopes, from the Agent Registry. Mode I downgrade pauses all autonomous actions tenant-wide.

ARCEB on Every Decision

Consensus path (proposal → verification → policy gate → commit) is fully logged before the result is shown.

Model Watch — 60-Day Lag

New model adoption lags provider release by 60 days and requires CEO approval. Verified beats current.

XAS-1 Working Paper →

Subprocessors

Every vendor. Generated from the adapter registry.

This list is generated from the X.R.A.Y. Integration Hub (XIH) adapter registry — the same registry that enforces the Adapter Mandate at runtime (LD-276 Rule 1). A vendor not listed here has no path to customer data.

Vendor	Category	Purpose	Data Access	Location
Anthropic PBC	AI / LLM	Language model inference (LD-287 model lock)	Content (encrypted in transit)	US
Deepgram Inc.	Voice / STT	Speech-to-text transcription	Content (encrypted in transit)	US
ElevenLabs Inc.	Voice / TTS	Text-to-speech synthesis	Content (encrypted in transit)	US
Stripe Inc.	Payments	Payment processing and billing	Metadata only	US
Twilio Inc.	Telephony / SMS	Phone provisioning, SMS, inbound webhooks	Metadata only	US
Resend Inc.	Transactional Email	Transactional email delivery	Content (encrypted in transit)	US
Amazon Web Services	Cloud Infrastructure	Compute (ECS Fargate), database (RDS PG 16), cache (Valkey), secrets, object storage — us-east-1	Content (encrypted in transit)	US (us-east-1)
Syncfusion Inc. (BoldSign)	E-Signature	Electronic signature workflows	Content (encrypted in transit)	US
CorpNet Inc.	Business Formation	LLC and corporation registration	PII (encrypted in transit, contractually protected)	US
Dun & Bradstreet	Business Credit	Business credit profile retrieval via SCORIVA	Metadata only	US
U.S. GSA (SAM.gov)	Government Data	Federal contractor and VOSB/SDVOSB status (public API)	No customer data transmitted	US
U.S. Treasury (USASpending)	Government Data	Federal award and spending data (public API)	No customer data transmitted	US
V.E.R.I.F.Y.™ (native)	Identity Verification	Veteran and citizen identity verification (PAT-118)	PII (encrypted in transit, contractually protected)	US

Incident Response

24-hour acknowledgement. Clear communication. No surprises.

X.R.A.Y. maintains documented incident response procedures covering detection, containment, eradication, recovery, and post-incident review. All procedures are trained on quarterly.

Affected customers notified within 72 hours of confirmed breach
Post-incident report published within 30 days
Status page reflects all ongoing incidents in real time

status.25xray.ai →

Vulnerability Disclosure

Report a security issue.

If you discover a security vulnerability in X.R.A.Y. products or infrastructure, please report it to us. We acknowledge receipt within 24 hours and commit to a first response within 5 business days. We do not pursue legal action against good-faith researchers.

security@25xray.ai

Include: description, reproduction steps, affected URL or component, and your contact information.

Common Questions

Security questions, answered directly.

Where does X.R.A.Y. stand on SOC 2?: Not yet. X.R.A.Y. is built to SOC 2 Type II Trust Services Criteria and has been in active evidence collection since September 1, 2026. An independent auditor engagement is in progress. We will communicate the audit outcome when it is complete and will not claim a certification before it is held.
Where is my data stored?: All X.R.A.Y. production data is stored in AWS us-east-1 (Northern Virginia). No data is replicated to any other AWS region without explicit customer instruction. Disaster recovery architecture specifications are in preparation.
Is my business data shared with other businesses on X.R.A.Y.?: No. Row-Level Security is enforced on every database table. Tenant A cannot read, write, or detect the existence of Tenant B's records. This is an architectural constraint — not a policy agreement.
How long are audit logs retained?: All audit records are retained for seven years under the ARCEB (Audit Record and Compliance Evidence Base) standard. Records are append-only — no one can change or remove them, including platform operators.
What encryption does X.R.A.Y. use?: AES-256 encryption is applied to all data at rest including database volumes, file storage, and backups. All data in transit uses TLS 1.2 or higher. No plaintext transport is permitted in any environment.
How does X.R.A.Y. govern AI agents?: X.R.A.Y. operates under XAS-1 (X.R.A.Y. Autonomy Standard v1.0), which classifies every agent action as reversible or irreversible before execution, requires machine-verified telemetry before any impact claim, and hard-exempts veteran-safety flows from autonomous commit. Every agent decision carries a plain-language explanation and reversal window. The full XAS-1 working paper is available at /trust/xas1.
How do I report a security vulnerability?: Email security@25xray.ai with a description of the vulnerability, reproduction steps, and your contact information. We acknowledge receipt within 24 hours and commit to a first response within 5 business days. We do not pursue legal action against good-faith security researchers.
Can I request compliance documentation such as a DPA or security questionnaire response?: Yes. Use the Document Request form on this page to request a Data Processing Agreement (DPA), security overview, vendor questionnaire response, subprocessor list, or SOC 2 readiness documentation. Our security team responds within 2 business days.

Document Request

Request compliance documentation.

NDA-gated documents are reviewed and delivered by our security team within 2 business days. Provide your organization details and the document type needed.