Xalios
Get a Demo
Company/Trust and Compliance

What we do,
and what we don't claim.

Most vendors open this page with badges. We would rather show you where things actually stand today, including what is not finished yet. We keep this page updated as each programme moves forward, so you can check back here for the latest progress at any time.

Book a demo→

Where our certifications stand

We are partway through the implementation of the four frameworks below. Work is underway with our auditors, but none of them is finished today, so we describe each one as in progress rather than claimed. Our target for all four is certification by the end of Q4 2026.

In progress
SOC 2

Implementation is underway, with the audit to follow it. We will publish the report when it exists rather than describing ourselves as ready.

In progress
ISO 27001

The information security management system is being built now. Certification comes after the audit, and our target is the end of Q4 2026.

In progress
ISO 42001

Our AI management system is being implemented against this standard, covering how AI employees are governed, supervised, and held to account.

In progress
GDPR

Our data protection programme is being formalised against GDPR, covering lawful basis, data subject rights, and processor agreements.

Enterprise only
Fully isolated tenancy

Enterprise customers can run on fully isolated tenancy, where their data sits on infrastructure no other customer uses. The option is not available on other tiers yet.

Enterprise only
Data residency choice

Enterprise customers can choose the region where their data is processed. The option is not available on other tiers yet.

Subprocessors

Three, each with what it does and what reaches it. The list is maintained as changes happen rather than at a review, and customers get written notice before a new one starts processing.

Microsoft Azure

Hosting, storage and the database. All customer documents and the memory built from them are held here, in the United Kingdom.

Groq

Model inference. Receives the text needed for the question or item being worked, and does not train on it.

Cohere

Language processing over document text. Receives document content for that purpose only, and does not train on it.

Storage stays in the United Kingdom. Model providers operate internationally, so text sent for inference may be processed outside the UK under standard transfer terms. If that is a blocker, tell us in week one. The terms this sits under are in the data processing agreement.

Still evaluating us?

If your procurement process requires a certification we do not have yet, we would rather you knew in week one than in month three. Ask us and we will answer plainly.

Book a demo→How the platform is built