## TRUST CENTER

# Trust & Security

Everything your security, privacy and vendor-risk teams need to evaluate XPOSER.AI — in one place.

### Certifications & audits

SOC 2 Type I audit in progress with [AUDITOR NAME]; report expected [MONTH 2026]. ISO 27001 gap assessment underway. Independent penetration test completed [DATE] — executive summary available under NDA.

### Data protection

All data encrypted in transit (TLS 1.3) and at rest (AES-256). Customer data is logically isolated per tenant. Regional hosting available in Saudi Arabia, the United States, Canada and the EU; your data resides in your chosen region.

### Anonymity architecture

Reporters may stay fully anonymous. We store no voiceprints and perform no voice matching. Optional voice masking and transcript-only delivery. Two-way follow-up runs through a zero-knowledge channel that even XPOSER.AI administrators cannot link to an identity. [Browse our resources →](https://xposer.ai/resources.html.md)

### AI governance

AI recommends; humans decide. Every classification ships with policy citations and reasoning. Monthly calibration reports measure AI/human agreement. No customer data is used to train models for other customers.

### Compliance alignment

- EU Whistleblower Directive

- SOX

- GDPR

- Saudi PDPL

- SAMA Whistle Blowing Policy

- HIPAA (BAA available)

- Quebec Law 25

### Subprocessors

Cloud and AI vendors engaged per hosting region.

| SUBPROCESSOR | US/CANADA | EUROPE | KSA | UAE | ASIA |
|---|---|---|---|---|---|
| Grok STT | ✓ | ✓ | ✗ | ✗ | ✓ |
| ElevenLabs TTS | ✓ | ✓ | ✗ | ✗ | ✓ |
| Gemini LLM | ✓ | ✓ | ✓ | ✓ | ✓ |
| Grok Fallback LLM | ✓ | ✓ | ✗ | ✗ | ✓ |
| Cloudflare R2 | ✓ | ✓ | ✓ | ✓ | ✓ |
| MongoDB Atlas | ✓ | ✓ | ✓ | ✓ | ✓ |
| LlamaParser | ✓ | ✓ | ✗ | ✗ | ✓ |
| LiveKit | ✓ | ✓ | ✗ | ✗ | ✓ |
| Firebase | ✓ | ✓ | ✓ | ✓ | ✓ |
| LangSmith | ✓ | ✓ | ✗ | ✗ | ✓ |
| Pinecone | ✓ | ✓ | ✗ | ✗ | ✓ |
| MS Graph API | ✓ | ✓ | ✓ | ✓ | ✓ |

### Contact

[info@xposer.ai](mailto:info@xposer.ai) · DPA template download.