Material changes to Exa Labs, Inc.’s public trust documents, each linked to its source.
Data as of 2026-10-19 — refreshed on a rolling bake, not live. · exa.ai
Permits training on customer data
Reviewed by a Driftline analyst · as of 2026-09-21
5 material changes in the last 12 months
Summaries are AI-generated and can be wrong. Check the source document linked on each change before relying on it. Vendor? Request a correction.
medium · AI feature launched · 2026-09-26 · Privacy Policy
Exa Labs' privacy policy page banner now promotes "Exa Agent Ultra" ("Frontier Quality at a Fraction of the Cost"), replacing the previous "Exa Snapshot" promotion. This announces the launch of a new vendor AI feature, though the diff discloses no data-processing details.
Source documentmedium · Terms changed · 2026-09-16 · Trust Center
Exa Labs substantively reworked the security controls disclosed on its trust center: it removed several controls (production database access restricted, firewall access restricted, password policy enforced, MDM system utilized, configuration management system established, SOC 2 - System Description) and added others (encryption key access restricted, unique account authentication enforced, asset disposal procedures, contractor code-of-conduct/confidentiality acknowledgments, penetration testing, DR plan establishment/testing), plus a new "Data and privacy" section (data retention procedures, customer data deleted upon leaving, data classification policy). No AI subprocessors, training rights, or retention periods were changed.
Source documentmedium · Data retention changed · 2026-09-10 · Trust Center
Exa Labs removed data retention and deletion commitments from its trust center, deleting the "Data retention procedures established" and "Customer data deleted upon leaving" controls. The page also dropped other security commitments (penetration testing, disaster recovery plan establishment/testing, encryption key access restriction, asset disposal), but the removal of customer-data deletion commitments is the most significant change.
Source documentmedium · AI feature launched · 2026-08-12 · AI Disclosure
Exa Labs disclosed a new AI-powered feature: "Exa in Slack," a Slack app integration that includes Exa-operated services and application logic powering the @Exa integration. The disclosure also explicitly excludes Slack-owned systems from the vendor's bug bounty scope, indicating this is a newly launched integration processing customer interactions within Slack.
Source documenthigh · Training rights changed · 2026-06-29 · Privacy Policy
Exa Labs' updated Privacy Policy now explicitly discloses that Query Data (customer search queries) is used to "train and fine-tune models that power our Services," and that the company collects information from publicly accessible sources to "train and fine-tuning models that power our Services." This represents a newly disclosed training right for customer query data with no opt-out mechanism mentioned.
Source documentPaste your vendor list and confirm your email, and we build your report and email it to you — the material changes across your vendors in the last 12 months, which of them added AI subprocessors or reserved the right to train on your data, and where your nth-party exposure concentrates. Free.