Exitr security and privacy summary

SIG Advisory LLC · info@exitr.ai · version 2026-10-11

Service

Exitr is an information service: company-level intelligence compiled from public sources. It is not a broker or adviser and never takes a fee tied to a transaction.

Data we hold about customers

Account data: name, work email, organization, role, settings.
Customer content: buy boxes, notes, statuses (owned by the customer).
Security data: IP address, device identifier for fraud prevention, audit log (2 years).
Billing: handled by Stripe; no card numbers stored by Exitr.

Data about companies

Company-level facts only from public and licensed sources. No personal contact data, owner ages, home addresses or social profiles. Companies can request correction or removal (10 business days).

Controls

Row-level security isolates every tenant table; automated cross-tenant tests on every change.
TLS in transit; encryption at rest; application-level encryption for secrets.
Magic-link, Google/Microsoft domain sign-in; optional or required TOTP MFA; 14-day idle session expiry.
Least-privilege database roles; secrets only in environment variables.
Rate limits, scraping detection, export marker rows.
Daily backups, point-in-time recovery, monthly restore tests; RPO 1 hour, RTO 4 hours.
Error monitoring and alerting; written incident response plan.

Sub-processors

Vercel: Web hosting
Supabase or Neon (Postgres): Database
Railway or Fly.io: Background worker
Stripe: Payments, billing and tax
Resend: Email delivery
Anthropic: AI processing (summaries, support answers)
PostHog: Product analytics (with consent)
Sentry: Error monitoring
Twilio: Phone verification

AI

Models only rearrange and explain sourced facts; a validator rejects unsupported claims. Customer content is never used to train shared models.