ExBrain

Security is the foundation. Not a feature.

Ex.Brain was architected security-first from day one. Every brain only sees what it is allowed to know. Every access is checked. Every sensitive action is logged immutably.

Talk to our security teamRead the architecture

Built by a CISO.

Adam Sepehri, Co-Founder & CTO / CISO. Security and cloud architect with 20 years' experience. PhD in Computer Vision, MS in AI. Former senior roles at Microsoft and Salesforce.. Spent two decades architecting authentication, authorization, and access control at planetary scale before building Ex.Brain's security layer from scratch.

Security is not a layer added afterward. It is embedded into the architecture itself — from the centralized IAM Policy Decision Point to the immutable audit logs, from mTLS service identities to deny-by-default authorization.

Architecture independently validated against the source code, May 17, 2026.

Seven layers. No single point of trust.

  • Defense in Depth

    Multiple independent protections across every level — identity, authorization, infrastructure, encryption, audit, and operations. No single layer is trusted by itself. Fail-closed by default: access is deny-by-default unless explicitly granted.

  • Permissioned Intelligence

    RBAC and ABAC combine with per-collection visibility classification so access is evaluated at retrieval time, every time. The scope-on-assignment model means a role alone never grants access — context and data scope are both evaluated.

  • Centralized IAM

    A single IAM service is the authoritative control point for all authorization decisions. Application services have read-only access to authorization state — they never write it directly. Layered enforcement: the gateway checks first; each service checks again.

  • Encryption Everywhere

    All data encrypted at rest on Azure infrastructure. All communication uses HTTPS/TLS with a minimum of TLS 1.2 and strong AEAD cipher suites. Internal service communication uses mutual TLS (mTLS) with SPIFFE-based service identities.

  • Immutable Audit Logs

    Every sensitive IAM operation is audited in append-only, immutable logs. INSERT and SELECT only — UPDATE and DELETE are blocked at the database level and verified by automated tests. Audit context propagates across service boundaries via trusted headers.

  • Operational Resilience

    Blue/green deployment with instant rollback: if a security regression is detected, traffic reverts to the previous known-good version instantaneously. Security controls can be tightened in real time without redeployment — the window between detecting and mitigating is measured in moments.

  • Human-in-the-Loop AI Governance

    Every AI Member has a human manager and an explicit approval chain. AI Members cannot act outside their defined scope without human approval. Budgets and permissions are set at the AI Member level, the Brain level, and the individual task level.

Two architectural guarantees.

Not policies. Not settings. Architecture.

Customer-Controlled Visibility

Every data point carries its own visibility classification, controlled by the customer — not the platform. Collections can be workspace-only, shared with child tenants, or fully restricted. On-demand grants add exceptions without widening the default classification.

Permission-Bounded Retrieval

The AI cannot surface what the person asking could not already reach. Not by policy. By architecture. RBAC roles, ABAC attributes, and visibility classification are all evaluated at retrieval time, every time — regardless of which Brain is being queried.

Threats modeled. Controls mapped.

STRIDE threat modeling applied to every layer of the platform. Validated against the source code, May 17, 2026.

ThreatControl
SpoofingAuth0 identity provider, mTLS with SPIFFE-based service certificates, HTTP-only session cookies with SameSite enforcement, and CSRF token middleware prevent identity spoofing at every layer.
TamperingImmutable append-only audit logs, TLS in transit with strong AEAD cipher suites, Azure-managed encryption at rest, and secrets managed in Azure Key Vault prevent unauthorized data modification.
RepudiationAll sensitive IAM operations logged with actor identity propagated across service boundaries. Append-only audit log with UPDATE and DELETE blocked at the database level and verified by automated tests.
Information DisclosurePermission-Bounded Retrieval ensures the AI cannot surface data beyond what the requesting identity can reach. Encryption at rest and in transit, operational data redaction, and least-privilege access policies limit exposure surface.
Denial of ServiceRate limiting enforced at gateway level, application level, and logging pipeline. Live IAM-managed controls allow operators to tighten limits in real time without redeployment.
Elevation of PrivilegeScope-on-assignment model, deny-by-default authorization, layered PDP + PEP enforcement, and read-only application access to authorization state. Services receive minimum required permissions — no implicit escalation path.

Compliance roadmap.

SOC 2 Type 2

In progress. Expected Q3 2026.

HIPAA BAA

Available at Business and Enterprise tiers.

Data Residency

US standard. EU available at Business+. Custom at Enterprise.

SOC 2 Type 2 certification is in progress and has not been awarded. We do not claim certification.

Bring your security team. We'll answer everything.

Talk to our security team