Security | Xano
Security your IT team can verify, not just read about.
Certifications are the starting point, not the story. Everything beyond them is inspectable: every endpoint, every change, every approval, and who or what made it, visible to the team that answers for it.
Certifications
ISO 9001 · SOC 2 Type 2 · SOC 3, independently audited.
SOC 2 TYPE II
SOC 3
ISO 27001
ISO 27701
ISO 9001
HDS
DPF
GDPR
HIPAA
CCPA
FERPA
PIPEDA
LGPD
Frequently asked questions
How would your IT team know it’s secure?
Because they can see it, control it, and prove it, without taking our word for any of it. The next three answers break that down.
What can our IT team see?
Every endpoint, every change, and who or what made it. The workspace is the live system, not documentation that drifts: the business logic, the APIs it touches, and the full change history are readable by the engineer who inherits it and the risk team that answers for it. When an agent makes a change, it’s attributable, timestamped, and reviewable the same way a person’s is.
What does our IT team control?
The harness. Your team sets the rules once and every build inherits them: which auth patterns and identity stack apply, who can access what (RBAC, enterprise SSO), where data lives (region and residency), which code dependencies are allowed, and which review gates a change must clear before it ships. Nothing reaches production except the immutable release your team inspected and promoted; policy is enforced during the build, not reported after the fact.
What do we hand the auditor?
Audit logs, full request history, version history, and rolling backups: the record of what ran, when, and on whose approval, alongside the certifications listed below. PII handling is stateless, request history has an off-switch, and we don’t train on customer data.
If we leave, can we take everything with us?
Yes. Everything you build in Xano is exportable. Your data lives in a standard Postgres database and exports directly; at volume, we help you move it. Your logic, schema, and tests are readable and translatable to the language of your choice, with AI assistance and a human in the loop.