Skip to content

Trust Center

Your data never leaves. By design.

A security tool should never become the exposure. xRazor runs entirely inside your network, so the most sensitive thing you own never has to trust us.

Data egress
Zero
Runs on
Your hardware
AI model
Local
Site cookies
None

What we see, and what we never can

The platform has no channel back to us. That isn't a setting you have to trust — it's how the product is built.

Never leaves your network

  • Scan results and findings
  • Credentials and secrets
  • Logs and the audit ledger
  • Source code and configuration
  • Network maps and asset inventories

The only things we receive

  • The emails you send us
  • The details you enter when you book a call
  • Anything you choose to share for support
  • Anonymous website usage statistics (no cookies)

How we handle it is set out in our Privacy Policy.

Built to attack safely

xRazor performs real attacks. These controls are what make that safe to run against production.

  • Inside your boundary

    The platform installs on your infrastructure and makes no outbound calls. There is no cloud tier and nothing phones home.

  • Air-gap ready

    Installs and runs where there is no internet connection at all — including restricted and classified networks.

  • A private, local model

    The AI that plans attacks reasons on your hardware. Your data is never sent to a third-party model provider or used for training.

  • Scope, enforced

    Every action stays inside the scope you define. Exploitation proves impact without causing damage.

  • A sealed audit ledger

    Every scan, exploit and finding is recorded in a tamper-evident log that stays in your environment — evidence of exactly what ran, and when.

  • Proof, not guesses

    Findings are replayed until they are verified, so your team acts on real, reproducible issues with evidence attached.

Evidence your auditors ask for

Verified findings and the sealed ledger give you the testing evidence these frameworks require. Mapping shown for reference — your auditor decides what satisfies a control.

SOC 2
Vulnerability detection and monitoring evidence (CC4.1, CC7.1)
ISO/IEC 27001:2022
Management of technical vulnerabilities (Annex A 8.8)
PCI DSS v4.0
Penetration testing and remediation evidence (Req. 11.4)
NIST CSF 2.0
Continuous vulnerability identification (ID.RA)

Found a vulnerability?

We hold ourselves to the standard we test others against. Report it to us — good-faith research is covered by our safe-harbor promise.

Disclosure policysecurity@xrazor.io

Machine-readable: /.well-known/security.txt

Policies

Running a vendor review? Send your security questionnaire to security@xrazor.io.