Start free

Security your IT team can verify, not just read about.

Certifications are the starting point, not the story. Everything beyond them is inspectable: every endpoint, every change, every approval, and who or what made it, visible to the team that answers for it.

Talk to an engineer How AI code governance works
Signal board

Certifications

ISO 9001 · SOC 2 Type 2 · SOC 3, independently audited.

  • SOC 2 Type II
  • SOC 3
  • ISO 27001
  • ISO 27701
  • ISO 9001
  • HDS
  • DPF
  • GDPR
  • HIPAA
  • CCPA
  • FERPA
  • PIPEDA
  • LGPD

Does Xano sign a HIPAA BAA?

Yes, with the HIPAA add-on: Xano signs a BAA as part of the Enhanced security add-on (HIPAA + BAA and more), a paid add-on on the Pro plan and included on Custom plans; see pricing. For how Xano’s infrastructure, isolation model, and security features support HIPAA-aligned workflows, read the guide to building HIPAA-compliant apps.

HIPAA-compliant apps Security guide Trust center
Is Xano secure? How would your IT team know?

See it, control it, prove it.

Because they can see it, control it, and prove it, without taking our word for any of it.

  1. 01 · See

    What can our IT team see?

    Every endpoint, every change, and who or what made it. The workspace is the live system, not documentation that drifts: the business logic, the APIs it touches, and the full change history are readable by the engineer who inherits it and the risk team that answers for it. When an agent makes a change, it’s attributable, timestamped, and reviewable the same way a person’s is.

    Live workspace GET /orders POST /orders PATCH /users DELETE /sessions Change history edited POST /orders agent · timestamped reviewed the change person · timestamped promoted release person · timestamped every endpoint, every change, who or what made it
  2. 02 · Control

    What does our IT team control?

    One set of workspace rules. Your team sets them once and every build inherits them: which auth patterns and identity stack apply, who can access what (RBAC, enterprise SSO), where data lives (region and residency), which code dependencies are allowed, and which review gates a change must clear before it ships. Nothing reaches production except the immutable release your team inspected and promoted; policy is enforced during the build, not reported after the fact.

    The rules · set once Auth RBAC·SSO Region Deps Review every build inherits them, enforced during the build Immutable release promoted nothing else reaches production
  3. 03 · Prove

    What do we hand the auditor?

    Audit logs, full request history, version history, and rolling backups: the record of what ran, when, and on whose approval, alongside the certifications listed above. PII handling is stateless, request history has an off-switch, and we don’t train on customer data.

    For the auditor ✓ Audit logs ✓ Request history ✓ Version history ✓ Rolling backups Policies PII handling stateless Request history off-switch Training on your data never what ran, when, and on whose approval
  4. 04 · Leave

    If we leave, can we take everything with us?

    Yes. Everything you build in Xano is exportable. Your data lives in a standard Postgres database and exports directly; at volume, we help you move it. Your logic, schema, and tests are readable and translatable to the language of your choice, with AI assistance and a human in the loop.

    everything you build is exportable Postgres exports directly Logic · schema · tests readable, translatable AI assistance, a human in the loop

AI builds software. Xano makes it trustworthy.

Bring your security review. We'll show you every signal on the line.

Talk to an engineer