Skip to content
Exitr
Start free trial

Security and trust

Exitr is operated by SIG Advisory LLC. We protect two things: your private data, and our own data asset.

Tenant isolation

Every customer's buy boxes, notes and statuses are isolated by row-level security in the database, plus a server-side permission check. An automated test tries every cross-customer read and write for every role on every change.

Sign-in

Email magic links, or Google and Microsoft restricted to your company domain. Optional authenticator-app two-step sign-in; Owners can require it. Sessions end after 14 days without use.

Encryption

TLS everywhere. Encrypted at rest in the database and file storage. MFA secrets and integration tokens are encrypted again by the app.

Payments

Card data never touches Exitr. Stripe holds it.

Least privilege

Separate database roles for the app, background jobs and reporting. Secrets live only in environment variables.

Protecting the data

No bulk endpoints, paginated lists, rate limits and scraping detection. Exports carry marker rows that trace a leaked file to its account.

AI agents

Agents treat every web page and email as data, never as instructions; they hold no secrets and can only call approved sources. Coding agents cannot change sign-in, billing, permissions or database migrations without approval.

Monitoring and response

Error tracking, alerts on failed-login bursts, permission changes and export spikes, and a written incident response plan with customer notice as the law and contracts require.

Backups

Daily backups with point-in-time recovery, copied to a separate account; restores tested monthly. Targets: lose no more than 1 hour of data; restore within 4 hours.

Procurement pack

Everything a deal team usually asks for, without a call.

Uptime and incidents

Target: 99.5% monthly uptime. Live status and incident history with written postmortems: status.exitr.ai.

Report a security issue

Email info@exitr.ai with "Security report" in the subject. A person reads every report.