Organization Overview

About Xano

Xano is a backend platform that helps teams build, validate, deploy, and scale modern applications, APIs, workflows, integrations, and AI-enabled backend services. The Xano platform supports backend development through a combination of visual development, code-based workflows, and AI-assisted building, allowing teams to move quickly while maintaining visibility and control over what is created.

As AI-generated code becomes more common, Xano is designed to help teams review and understand backend logic before it is deployed. Xano’s visual validation capabilities allow customers to inspect generated endpoints, data models, workflows, and business logic in a more transparent format, supporting human-in-the-loop review, collaboration, and governance over AI-assisted development. This helps technical and non-technical stakeholders better understand how backend systems are structured and how application logic is expected to behave.

How To Read This Trust Center

Throughout this Trust Center, references to “Xano,” “we,” “our,” and “us” refer to Xano and the Xano services described in the applicable agreement, policy, or Trust Center page.

References to “you,” “your,” “users,” or “customers” generally refer to individuals or organizations that have signed up for, access, or use Xano, including both free plan users and paid plan customers. Certain Trust Center sections, features, commitments, agreements, certifications, add-ons, or support options may apply only to specific plans, products, deployment models, contractual arrangements, or paid services. Where a section is limited to certain customers or use cases, we will identify that limitation in the relevant section.

This Trust Center is intended to provide general information about Xano’s security, privacy, compliance, and governance practices. It should be read together with Xano’s applicable Terms and Conditions, Privacy Notice, Data Processing Addendum where applicable, Business Associate Agreement where applicable, and any other agreement that applies to your use of Xano.

Xano does not provide legal, regulatory, or compliance advice; we provide information about our security posture and general recommendations for using Xano more securely or how compliance responsibilities are divided. Users are encouraged to consult qualified experts to understand their specific responsibilities and requirements.

Our Roles In Processing Your Data

Xano primarily acts as a data processor for data that customers place into and process through their Xano accounts, workspaces, applications, databases, APIs, workflows, and related platform services. In this role, we process data on behalf of customers in accordance with the platform's functionality and, where applicable, customers’ instructions.

We also act as a data controller for certain information we collect and use for our own business and operational purposes, such as account information, contact details, website activity, product usage, analytics data, support interactions, and similar information. Where Xano acts as a data controller, Xano takes steps designed to protect that information and, where appropriate, uses measures such as minimization, pseudonymization, anonymization, access controls, and region-based cookie preference options.

Unless otherwise stated, the security and compliance information in this Trust Center primarily describes Xano’s controls and safeguards for protecting customer data processed through the Xano platform. This distinction is important because customers control the data, application logic, access permissions, integrations, and end-user experiences they build in Xano, while Xano provides the underlying platform, infrastructure, security controls, and supporting compliance documentation.

Customer Control & Xano Access

Customers maintain control over the data and configurations within their Xano accounts and workspaces. Xano’s team has limited access to customer environments and does not routinely access customer application data except where needed to provide the services, respond to customer-authorized support requests, address security or operational issues, or comply with applicable legal obligations.

In general, Xano accesses customer accounts or workspaces only with customer authorization, such as when a customer initiates a support request or specific inquiry. Customers may control support access through workspace settings that can be enabled or disabled, including settings that permit authorized Xano support personnel to assist by accessing or impersonating an account for troubleshooting purposes. In limited circumstances, Xano may also access or disclose information where required to respond to valid legal requests or as otherwise described in Xano’s Privacy Notice.

Xano may separately collect analytics and usage information related to website activity, product interactions, and computing or service usage. This information is handled in accordance with Xano’s Privacy Notice, applicable cookie preferences, and regional privacy requirements. Customers should review Xano’s Privacy Notice for additional information about what information Xano collects, why it is processed, and what choices or rights may be available.

Security, Compliance, & Shared Responsibility

Xano maintains a security and compliance program designed to support the certifications, attestations, regulatory alignment areas, and customer assurance materials referenced in this Trust Center. These materials are intended to help customers evaluate Xano’s security posture, privacy practices, compliance alignment, and governance approach.

In practice, security and compliance are shared responsibilities between Xano and its customers. Generally, Xano is responsible for maintaining the platform, infrastructure, organizational controls, security program, and supporting compliance documentation that apply to the Xano services. Customers are responsible for how they configure, build, secure, and operate their own applications, APIs, workflows, databases, authentication and authorization settings, integrations, user access, end-user notices, and data processing activities within Xano.

Additional information about the shared responsibility model is available on the Shared Responsibility page.

Questions, Privacy Requests, and Security Reporting

Customers and prospective customers should review the Trust Center, Privacy Notice, Terms and Conditions, and other applicable documentation for additional information about Xano’s security, privacy, and compliance practices. Security questionnaires may be completed for enterprise or custom plans only, on a case-by-case basis.

• For questions relating to Xano plans, offerings, and other general information not specific to compliance, users may contact support@xano.com
• For general security questions or to report a security incident, users may contact security@xano.com
• For privacy-related inquiries, including requests related to data subject rights or other matters described in Xano’s Privacy Notice or Terms and Conditions, users may contact privacy@xano.com