Every statement published in this Trust Center reflects the verifiable, audited reality of XRAY Bridge in production today. We never sell hypothetical compliance certifications or claim capabilities we do not operate.
Verifiably true, production-audited list of sub-processors including Railway, Neon, OpenAI, Resend, Stripe, and Google. All infrastructure resides exclusively in the United States.
How Bridge discards full call transcripts (rawBufferTtlDays = 0), keeps only task-linked status changes and their short supporting quotes with One-Tap Clear and 72-hour correction, and isolates each workspace with per-tenant encryption and PostgreSQL Row-Level Security.
When AI review is enabled, what it can and cannot do, human review of uncertain matches, zero model training on customer payloads, and outbound PII/secret redaction policies.
Self-serve data export (GET /api/v1/organizations/export) and complete workspace purge (DELETE /api/v1/organizations) for workspace owners, plus 24-hour security@xray.tech SLA.
We welcome responsible security research and customer security questionnaires. Our security team responds to all inquiries within 24 hours. For reporting vulnerabilities, consult our RFC 9116 security policy at /.well-known/security.txt.