Procurement-ready answers,
without a sales call.
This page is built for security, procurement, and compliance reviewers. It answers the concrete questions you ask before approving a vendor: where data processes, what leaves your boundary, how we map to your compliance frameworks, how to report a vulnerability, and the current SOC 2 posture.
Where does data process?
Data residency and where RAXE detection logic executes relative to your infrastructure.
RAXE is designed so detection runs inside your control boundary. The detection engine, classifiers, and scoring all execute on infrastructure you operate: in your VPC, on your hosts, or in an air-gapped environment.
In Enterprise deployments, telemetry and logs stay on your side unless you explicitly opt in to share anonymised signals with RAXE Intelligence. Enterprise prompt and response content is not transmitted to a RAXE-operated scanning cloud as part of normal operation.
- Default deployment: detection runs inside your environment.
- Data residency: follows your hosting region. We do not move traffic across regions.
What leaves your boundary?
Your prompts and responses stay with you. We share anonymised detection telemetry to keep detections sharp. Enterprise can turn it off or run air-gapped.
- Prompts, responses, and session content
- Tool-call arguments and results
- Detection scores and verdicts
- Operating record and evidence exports
- Customer-specific configuration and policy
- Community Edition: on by default. Keeps detection sharp for everyone.
- Enterprise: opt out entirely, route through your own network, or run air-gapped.
The public browser demo on raxe.ai scans the prompt you paste as part of the detection walkthrough. Default on, toggle off in the demo.
What deployment models are supported?
Topology options and which integration path each model supports.
Control plane and detection agents all run inside your VPC. No RAXE-operated infrastructure in the traffic path. Signatures delivered via outbound HTTPS fetch.
Installed on customer hardware. Supports K8s DaemonSet, sidecar, systemd, and standalone Gateway deployments. Signature updates via internal mirror.
Fully disconnected deployment. Signature and model updates delivered out-of-band via signed packages. No outbound connectivity to RAXE services required.
What compliance frameworks map to which controls?
How RAXE capabilities support your framework obligations. Every entry links to the primary source.
Vulnerability disclosure
How to report a security issue responsibly, what is in scope, and our safe-harbour commitment.
SOC 2 posture
The current state of our SOC 2 programme and what we can share today.
SOC 2 programme status: in progress. RAXE has aligned internal controls to the SOC 2 Trust Services Criteria (Security, Availability, Confidentiality, Processing Integrity, Privacy) and is working through formal audit readiness. We do not claim a completed SOC 2 Type II audit.
For enterprise evaluations we can share the following under NDA:
- Control matrix mapped to SOC 2 TSC
- Current audit timeline and auditor relationship (when established)
- Security questionnaire responses (SIG Lite, CAIQ v4)
- Data processing agreement and sub-processor list
Ask the team for the current status: security@raxe.ai or book a walkthrough →.
Security research evidence
Public research output as proof of security maturity.
Still have questions?
Book a 30-minute call with a RAXE engineer. No sales funnel.
Book a walkthrough →