# exployt.ai Security FAQ
Last updated: 2026-07-08
Canonical FAQ page: https://exployt.ai/faq
Canonical Trust & Security page: https://exployt.ai/security

Q: Is my data encrypted?
A: Traffic between the app, the website, and exployt servers uses HTTPS with modern TLS 1.2/1.3. Passwords are stored as bcrypt hashes. Selected sensitive server-side fields use AES-GCM encryption and lookup hashes. Local secrets such as cached entitlement tokens, provider credentials, and build/deploy credentials that use the exployt credential stores are protected with Windows DPAPI under the current Windows user account. Local project databases and agent history stay on the customer's machine and are not sent to exployt cloud during ordinary desktop-app operation. Local database encryption can be enabled in the desktop app settings; when it is not enabled, the local SQLite database remains under the customer's own device and file-system security.

Q: Do you store my AI API keys?
A: No. exployt cloud does not store customer AI-provider API keys for ordinary desktop-app operation. API keys are entered and kept locally in the app or project credential areas used for the selected provider connection. Credential-vault and build/deploy secret stores protect persisted local secrets with Windows DPAPI under the current Windows user account. exployt cloud has no access to those local keys. For sensitive projects, customers can also choose local models through Ollama so prompts and project context do not leave the machine for AI inference.

Q: What data do you collect?
A: The Privacy Policy lists the exact categories. In short, exployt cloud processes account, authentication, billing, subscription/license, security, fraud-prevention, support/feedback, and consented website analytics data. exployt does not collect Big Data from customer projects, harvest project files, or build datasets from source code. Source code, file contents, local databases, agent history, and project details stay on the customer's machine during ordinary desktop-app operation. Marketplace publishing and support submissions are deliberate actions: Marketplace uploads send only the files and metadata the customer chooses for sharing or sale, and support/bug-report flows show the diagnostic data first and send only what the customer approves.

Q: Is exployt ISO 27001 or SOC 2 certified?
A: As of 2026-07-08, exployt is not ISO 27001 certified and does not provide a SOC 2 Type I or Type II report. exployt is preparing the control documentation, risk assessment, access-review evidence, incident-response evidence, vendor review, and management-review material needed for an ISO 27001 or SOC 2 readiness/audit process.

Q: Who operates exployt.ai?
A: exployt.ai is operated by exployt Software GmbH, Merangasse 53/3, 8010 Graz, Austria. Commercial register FN 675480d, Landesgericht fuer ZRS Graz. VAT ID ATU83180825. Managing director Michael Martin Schoeggl. Contact office@exployt.ai.

Q: Where is exployt hosted and where is data stored?
A: The primary production web service is hosted on Microsoft Azure in the West Europe region (Netherlands). Customer source code, local project files, local project databases, local agent history, and local AI-provider API keys stay on the customer's machine during ordinary desktop-app operation. If the customer intentionally publishes an item to the exployt Marketplace, selected files and metadata for that item must be uploaded to exployt servers so the item can be reviewed, hosted, shared, sold, and delivered to other users. Marketplace items can include integrations, modules, standalone apps, settings sets, workflows, connector packages, or other reusable assets; the customer chooses what to include, and exployt recommends minimization plus obfuscation where appropriate. For support, feedback, and bug reports, the app or website shows the data to be submitted before sending and submits only what the customer confirms.

Q: Do you offer a Data Processing Agreement (DPA)?
A: Business and enterprise customers can request a DPA by contacting office@exployt.ai. exployt is preparing a public DPA package and expects to publish it in the coming weeks.

Q: Which subprocessors do you use?
A: Current providers for the public website, account service, billing, email, security, and optional website analytics stack include Microsoft Azure, Stripe, Resend, MaxMind offline geolocation data, and optional Google Analytics 4 / Microsoft Clarity website analytics where enabled. Customer-selected AI providers, Git services, tools, plugins, connectors, OpenRouter, and local Ollama models used by the desktop app are chosen or configured by the customer and are not exployt cloud subprocessors for local project content.

Q: How are secrets, keys and passwords protected?
A: Passwords are bcrypt hashed. Traffic uses HTTPS with modern TLS 1.2/1.3, which is the standard transport protection for web traffic. Selected sensitive server-side fields use AES-GCM encryption and lookup hashes. Local Windows secrets in the exployt credential stores use DPAPI. Selected service secrets and signing material are managed through Azure Key Vault where configured. Local project databases and agent history are not sent to exployt cloud during ordinary desktop-app operation.

Q: Do you provide an SLA or guaranteed support response time?
A: Support requests sent to office@exployt.ai or submitted through product support/feedback forms receive an initial response within 24 hours. exployt cloud is needed for account creation, login/account management, billing, payment, subscription/license validation, Marketplace cloud actions, and fresh entitlement checks. Ordinary desktop project work is local-first: the desktop app keeps a signed entitlement snapshot with a maximum 72-hour grace window, so transient server outages do not immediately remove access to subscription-locked features. If an exployt cloud outage occurs, the operational commitment is to restore the account/subscription service before that 72-hour grace window expires. This public commitment does not create service credits unless a separate written enterprise agreement says so.

Q: Can I export or delete my data?
A: Local project files, source code, agent history, local credentials, and the local project database remain under customer control. The project database is a local SQLite database stored under the project's .exployt folder; when local database encryption is not enabled, it can be inspected or exported with ordinary SQLite-compatible tools. exployt also provides export/import flows for workflows, settings sets, and many configuration assets such as agent/workflow settings, so customers can back them up, share them, or use them outside one installation. The Terms do not restrict customers from using their own local project data with other software. For cloud account data and personal data processed by exployt, customers can request access, deletion, restriction, or portability under the Privacy Policy and applicable law. Some records must be retained for legal, tax, fraud-prevention, dispute, or security reasons.

Q: Do you collect or review my source code?
A: exployt cloud does not collect, review, or train on source code, file contents, local databases, agent history, or project details during ordinary desktop-app operation. If the customer selects a cloud AI provider, the desktop app sends the prompts, files, snippets, or context needed for the task to that provider because cloud AI cannot work without receiving task context. The customer controls that choice: exployt supports direct provider connections, OpenRouter access to hundreds of models, and local models through Ollama for sensitive work where project content should not leave the machine. Marketplace publishing is a separate deliberate upload for selected files and metadata the customer wants to share or sell, and support/bug-report flows show the data first and send only what the customer confirms.

Q: How do you use hardware identifiers?
A: The desktop app may derive stable device-fingerprint signals from hardware and operating-system attributes. exployt reduces those signals to hashes/HMAC values and uses them only for account security, license integrity, known-device recognition and trial-abuse prevention, not analytics, marketing, advertising or cross-service tracking.

Q: How do I report a security issue?
A: Send security reports to office@exployt.ai with enough detail to reproduce or assess the issue. Do not include secrets, passwords or data that is not necessary for the report. The machine-readable security contact is published at https://exployt.ai/.well-known/security.txt.