Human oversight
AI agents are configured to assist, route and summarize. They should not make sensitive final decisions without client-approved human review.
✓Handoff rules✓Escalation triggers✓Role-based access
Compliance and responsible AI
Trust controls for business AI agents.
Exania builds AI agents, chatbots and automation systems with practical safeguards for privacy, security, transparency and human oversight. This page explains how we handle client projects, data, payments, AI limitations and operational risk.
Human handoff ready
Data minimization
Secure checkout
Restricted use rules
Operational controls
Built around business risk, not empty certification language.
Our compliance approach focuses on what matters for AI agents in production: what data is used, what the agent can say, when a human steps in, how payments are handled and how incidents are escalated.
Privacy by design
We minimize submitted data, avoid collecting unnecessary sensitive information and connect agents only to approved business sources.
✓Purpose limitation✓Client-approved sources✓Retention awareness
Security controls
Projects use secure transport, protected forms, limited operational access and separation between public pages and internal project data.
✓HTTPS-first deployment✓Input validation✓Private storage paths
AI limitations
Agents are not positioned as legal, medical, financial or emergency decision makers. Responses can be scoped, constrained and routed.
✓No guaranteed outcomes✓Client-specific disclaimers✓Fallback messages
Payment handling
Checkout is handled through secure payment links. Exania pages do not expose bank details or collect card data directly.
✓Gateway checkout✓Package references✓No card storage on site
Restricted use
We do not support projects intended for fraud, impersonation, spam, harmful deception or unauthorized access to data or systems.
✓Use-case screening✓Abuse prevention✓Service refusal rights
Framework alignment
How Exania maps compliance into real project delivery.
This is an operational alignment overview, not a claim that every listed framework certification has been independently awarded. Formal certification status should be requested separately if needed for procurement.
| Area | How we apply it | Typical evidence | Status |
|---|---|---|---|
| Privacy and GDPR readiness | Data minimization, clear purpose, consent-aware forms, privacy policy links and client-controlled knowledge sources. | Privacy Policy, project intake, data source list, retention notes. | Operational |
| Responsible AI | Human handoff, scoped responses, prohibited use cases, fallback messages and client review before launch. | Agent instructions, escalation rules, testing records. | Operational |
| Security by design | HTTPS-first implementation, private storage, input validation, least-privilege admin access and protected endpoints. | Deployment checklist, access list, incident log. | Operational |
| AI Act readiness | Use-case classification, transparency notices and additional review for sensitive or high-impact scenarios. | Use-case review, risk notes, client approval. | Case by case |
| Payment security | Checkout handled by payment gateway links. Exania web forms do not collect card numbers. | Checkout records, plan references, payment provider confirmation. | Operational |
| Client data governance | Client decides what documents, FAQs, policies and tools the AI agent may use. | Knowledge base inventory, integration approvals. | Client + Exania |
Data handling
Clear flow from visitor message to business action.
Every setup is different, but the same principle applies: collect only what the project needs, send it to the right business destination and avoid exposing operational details publicly.
Visitor asksThe user submits a question or lead request through the website widget.
Agent checks sourcesThe bot uses approved website pages, FAQs, policies or documents.
Lead is qualifiedThe agent asks for only the needed contact and project details.
Team receivesThe request is sent to the approved destination, such as email, CRM or dashboard.
Customer messageConversation starts in the approved WhatsApp business channel.
Intent detectionThe agent identifies support, sales, booking or handoff intent.
Human handoffComplex or sensitive cases are routed to the configured team contact.
Summary storedOnly needed lead or support details are kept for follow-up.
Event triggeredA form, lead, email, booking or internal action starts the workflow.
Rules appliedBusiness rules decide routing, labels, scoring and next steps.
Approved systemsOnly authorized CRMs, sheets, calendars or tools are connected.
Report generatedThe team receives summaries, alerts or dashboards for review.
Client responsibilities
Good AI agents need good business rules.
Exania builds and configures the system, but clients remain responsible for approving the business information, prices, policies, regulated claims and human escalation rules the agent will use.
Important: Exania agents should not be used as a substitute for licensed professional advice, emergency response, legal judgment, medical diagnosis or financial decision making.
Approve knowledge sources. Provide only documents, pages and policies the agent is allowed to use.
Define escalation rules. Decide when a human must take over the conversation.
Keep content updated. Prices, opening hours, availability and policies should remain current.
Review sensitive industries. Healthcare, legal, finance, employment and other regulated areas may require extra disclaimers or controls.
Respect end users. Do not use Exania for spam, impersonation, illegal profiling or deceptive automation.
Compliance support
Need a compliance-aware AI agent?
Start with a clear project brief. We will review your use case, channels, knowledge sources, handoff requirements and data flow before build and launch.
Compliance FAQ
Common questions.
Does Exania claim ISO or SOC 2 certification?
This page describes operational controls and framework alignment. Formal certification status should be requested separately for procurement or vendor review.
Can Exania handle sensitive data?
Sensitive data should be minimized. If a project involves regulated or sensitive information, we review the use case, data flow and required safeguards before accepting the scope.
Can an AI agent make decisions for my business?
Exania agents are designed to assist, answer, qualify and route. High-impact, regulated or sensitive decisions should remain with authorized humans.
Where are payments processed?
Payments are handled through secure checkout links. Exania public pages do not collect or store card numbers directly.
Can I request deletion or update of submitted data?
Use the contact or support page to request correction, export or deletion. We will review the request according to the applicable service and legal requirements.