Rules
How building is governed.
Your workspace rules: AI skills, test suites, dependencies, auth patterns, approved middleware, agent rules, data residency. Set by your team, inherited by every build, whichever agent is driving.
Xano for enterprise: Built for the systems your business depends on.
Deriv, Generali, and Heimstaden run core operations on Xano, with the rules visible, the changes governed, and the infrastructure operated in their cloud or ours.
GDPR · ISO 9001 · SOC 2 Type 2 · SOC 3 · HIPAA + BAA add-on
Running in production at
- Deriv
- Generali
- Heimstaden
The track your agents run on · nothing leaves the line
One set of rules for every team and every agent
Your team lays the rules once. Every build, by every agent, runs on them, and every change arrives with its evidence.
Evidence
See what was built: one shared picture.
The live system, drawn from what is running (logic, data, APIs) with the evidence attached: tests passed, policies held, who changed what. Readable by everyone who has to sign off.
The understanding layer Couplings
Fits your existing stack.
Xano couples to what you already run. See the full integration surface →
Your repo and CI
Write the backend in TypeScript with the Xano SDK. Strict export fails the build on any warning, with no secrets.
@xano/sdk Frontend-agnostic
Connect any front end, or host your static files on Xano.
static hosting Your identity stack
Enterprise SSO with GitHub, Google, and Microsoft Entra ID; SAML supported.
SSO · SAML APIs your services consume
Autogenerated OpenAPI docs on every endpoint.
OpenAPI Any agent
Claude Code, Codex, Cursor and more, via the Xano MCP and CLI.
MCP · CLI Your own runtimes
Any Docker container runs alongside governed logic. Inference never leaves your environment.
sidecars The enterprise line · from your first build to a decade in production
Deployment, isolation, security, exit and operations, for enterprise
- 01 · Deploy
Deployment control.
Managed, bring-your-own-cloud, or self-hosted; your jurisdiction, your keys. The same Xano Engine runs on a laptop, in CI, and in production. The common journey: start in your cloud, pass the trust gate, and hand over operations when we've earned it.
- 02 · Isolate
Isolation and tenancy.
A tenant per client, region, or even a user cohort: own database, own URL, own lifecycle. Release with per-tenant access control, backups, and logs.
Tenant Center - 03 · Secure
Security & compliance.
ISO 9001, SOC 2 Type 2, SOC 3. Stateless PII handling, request-history off-switch, no training on customer data.
Security - 04 · Exit
Never stuck.
Data in Postgres: exportable, always, assisted at volume. Logic, schema, and tests readable and translatable.
- 05 · Operate
Who runs it, and who answers the phone.
When Xano operates it, that means scaling, upgrades, and incident response, under SLA, with someone accountable at any hour. Underneath, Autopilot keeps every cluster right-sized continuously, and proves each change safe before it makes it.
Autopilot - 06 · Proven
The company.
Xano runs production backends today: trading operations at Deriv, serving 3M+ users across 150 countries; core systems at Generali across 30+ countries, saving $1M+ annually; and a country's property operations at Heimstaden, with €80B in investment properties.
Legacy modernization
Questions
Xano for enterprise, answered
Is Xano enterprise-ready?
Yes. Deriv (3M+ users across 150 countries), Heimstaden (€80B in investment properties) and Generali ($1M+ saved annually) run core operations on Xano. Custom plans add self-hosting, tenant isolation, SSO, high availability, 24/7 monitoring and dedicated support, and one set of workspace rules governs every build by every person and agent.
Can Xano run in our own cloud?
Yes. On Custom plans, Xano runs in your own AWS, Azure or GCP account, or on-prem, in your jurisdiction with your keys, and the same Xano Engine runs on a laptop, in CI and in production. The common journey is to start in your cloud, then hand operations to Xano: scaling, upgrades and incident response under SLA.
Which certifications does Xano hold?
Xano’s compliance covers SOC 2 Type II, SOC 3, ISO 27001, ISO 27701, ISO 9001, HDS, HIPAA, GDPR and DPF. Essential plans and above include GDPR, ISO, and SOC 2 & 3 compliance, and HIPAA is an add-on. PII handling is stateless, request history has an off-switch, and Xano doesn’t train on customer data. Details are on the security page.
Does Xano sign a BAA?
Yes. Xano signs a HIPAA BAA as part of the Enhanced security add-on (HIPAA + BAA and more), $500 a month on the Pro plan and included on Custom plans. For how Xano’s isolation model and security features support HIPAA-aligned workflows, read the guide to building HIPAA-compliant apps.
How does SSO work with Xano?
Xano’s enterprise SSO signs your team in through GitHub, Google or Microsoft Entra ID, and SAML is supported, so access follows your existing identity provider. SSO is part of the Custom plan. Role and permissions management, audit logs and version history then make every change attributable to the person or agent who made it.
AI builds software. Xano makes it trustworthy.
Bring your architecture. We'll show you the line it runs on.