Exogram
Exogram sits between an AI agent and the systems it can touch, checking every tool call against deterministic rules before it runs and keeping a permanent bank of verified facts. Built for developers, product teams and compliance-minded organizations.
What is Exogram?
Exogram calls itself an Authority Runtime: a layer placed between an AI agent and the systems it can actually touch, such as a database, a payment API or a file system. When a model tries to run a command, delete a file or spend money, Exogram checks whether the action is permitted before it executes, so that, in the vendor's words, the model never holds raw execution authority regardless of prompt drift, recursive loops or poisoned context.
The product has two halves. The Local Adaptor is an open-core sidecar that runs next to each agent, evaluates rules locally, writes a cryptographic SQLite ledger and coordinates peer to peer between nodes, with no cloud required. The Cloud Dashboard adds fleet observability, policy distribution and human-in-the-loop controls, plus SSO, compliance exports and SIEM feeds on the Enterprise tier. Decisions are deterministic by design: the site insists there is zero LLM in the decision path, and claims 0.07 ms per evaluation together with a load test of 5,000 concurrent requests, 200 simultaneous connections and 137 sustained requests per second at a 0.00% failure rate. Those figures come from the vendor and cannot be checked independently.
Four steps are documented: intercept the outbound payload, evaluate rules and state, record the attempt in a tamper-evident ledger, then commit the result to the memory bank. Blocks return documented codes such as POLICY_VIOLATION, EXFILTRATION_BLOCKED, SCHEMA_MISMATCH or STATE_DRIFT. The memory bank stores claims with a source and a confidence score and offers semantic search ranked by relevance times confidence, with PII scrubbing and conflict detection.
Integration runs through a REST call to the evaluate endpoint before each tool call, or through an MCP server. Exogram claims compatibility with twelve or more frameworks, among them LangChain, LangGraph, CrewAI, AutoGen, AutoGPT, LlamaIndex, Semantic Kernel, Haystack, Phidata and Composio, alongside an official Custom GPT, a Claude Desktop configuration and an npx exogram init command. Three deployment shapes are offered: multi-tenant SaaS with US and EU residency, a dedicated VPC with customer-managed keys, and an air-gapped sidecar with no external telemetry. The publisher is Exogram LLC, a Washington limited liability company founded by Richard Ewing and presented as independent and bootstrapped.
What it does
- Intercepts an agent's outbound tool call before it executes
- Evaluates the payload against deterministic local rules, in 0.07 ms according to the vendor
- Blocks or permits the action, returning a deterministic error code or a signed JWT execution token
- Seals every decision in a SHA-256 hashed ledger organized as Merkle tree roots
- Stores and retrieves verified facts in a memory bank that persists across sessions
- Caps spending and cuts off runaway recursive API loops
- Streams governance events to SIEM tools such as Datadog and Splunk
When to use Exogram / When not to
A quick filter to help you decide if Exogram is the right fit.
When to use Exogram
- Engineering teams that give autonomous agents real access to a production database, a terminal or a payment gateway
- Developers building on Claude Code, Cursor, LangChain, CrewAI, AutoGen or LangGraph who want a guardrail in front of tool calls
- Support teams running customer-facing chatbots on Shopify, Zendesk or Intercom that can issue refunds and discounts
- Compliance and risk owners who must produce audit evidence for SOC 2 Type II, EU AI Act Article 14, HIPAA or GDPR programmes
- Sovereign or air-gapped environments (SCIF, GovCloud, private Kubernetes) that need a self-hosted sidecar with no external telemetry
When not to use Exogram
- Anyone shopping for an AI model or an agent framework: the terms state that Exogram is not a model provider and neither authors nor executes your agents, it only sits in front of them
- Teams looking for output moderation or content filtering, since Exogram governs actions rather than the text a model produces
- The uses banned by the acceptable use policy: autonomous weapons, lethal systems, life-support medical devices, air traffic control, nuclear plants, critical municipal networks and financial fraud
- Buyers expecting the tool itself to guarantee complete coverage, as the terms explicitly disclaim any reliance on constraint perfection
- Minors, since the terms and the privacy policy both restrict the service to users aged 18 and over
How to use Exogram
A typical end-to-end flow, from setup to results.
- Try it without an account first: run the public Proving Ground simulator, or the free Code Risk Analyzer and Agent Safety Scanner
- Open an account on the permanent free plan, which covers 500 evaluations a month for one agent
- For the no-code route, launch the official Exogram Custom GPT inside ChatGPT
- For Claude Desktop, add the MCP server block with its url and apiKey to the configuration file, a setup the vendor advertises as taking ten seconds
- For Cursor or Claude Code, run npx exogram init in a terminal
- For custom code, POST an action_type and payload body to the /v2/evaluate endpoint before every tool call, authenticated with an Authorization Bearer key
- Handle the response: PERMITTED returns a signed JWT execution token, BLOCKED returns a deterministic reason code
- Write your own rules and constraints, then store verified claims through the vault endpoints with their source and confidence
- Go further with the published OpenAPI 3.1 specification, the Postman collection, the Python SDK or the documented CLI
- Review blocked attempts and audit ledger entries in the cloud dashboard, and watch the quota alert sent as you approach your monthly limit
Pros & Cons
Pros
- A genuinely permanent free plan rather than a countdown trial: 500 evaluations a month, one agent and the open-core local adaptor
- The core engine is said to work completely offline on your own machine, so evaluation can happen without sending anything to a third party
- Deterministic evaluation with no LLM in the decision path, advertised at 0.07 ms, which avoids the cost and lag of a second model watching the first
- Unusually complete public technical documentation for such a young product: OpenAPI 3.1, Postman collection, Python SDK, CLI and a fixed list of error codes
- The no-training commitment is written in binding legal language in the privacy policy, not only in marketing copy
- Sub-processors are named individually, with their role, and both US and EU data residency are offered alongside an air-gapped option
- Prices are published openly for three of the four tiers, with no forced annual commitment and, per the vendor, no lock-in on the data plane
Cons
- A very young company: the domain was registered on 24 January 2026, no Wayback Machine snapshot exists and long-term viability is unproven
- The SOC 2 Type II, HIPAA and EU AI Act references are framed as design alignment meant to support the customer's own audit, not as certifications Exogram holds; the SOC 2 report and the pen test have to be requested by email
- No postal address is published, and the legal name is inconsistent across the site: Exogram LLC in the terms and privacy policy against a footer reading Exogram Inc.
- The displayed pricing table (29 USD and 299 USD a month) contradicts the structured data embedded in the same page (99 USD and 2.50 USD)
- No refunds at all on subscription fees, API overage or setup charges, and liability is capped at the greater of twelve months of payments or 100 USD
- Mandatory individual arbitration and a class action waiver, with an opt-out window of only 30 days
- Every performance and traction figure comes from the vendor's own site and none can be verified independently; audit log retention is short on entry tiers, and there is no mobile app and no published list of interface languages
Pricing & Plans
There is a free plan, and it is permanent rather than a time-limited trial: one seat, one monitored agent, 500 evaluations per month, the open-core local adaptor, a SQLite ledger and community support. The lowest paid entry point is Pro Power User at 29.00 USD per month. Business & Apps costs a flat 299.00 USD per month, and Enterprise pricing is available on quotation only. Billing is charged in advance, monthly or annually, renews automatically and is processed through Stripe; fees are non-refundable and downgrades take effect at the end of the current cycle. Readers should note that the structured data embedded in the pricing page quotes different amounts, 99 USD and 2.50 USD, from the table displayed on the same page.
- 1 seat
- 1 agent
- 500 evaluations per month
- open-core local adaptor
- SQLite ledger
- community support
- 1 seat
- up to 3 agents
- cloud dashboard
- spend anomaly detection
- daily GDPR and PII sweeps
- email support within 24 hours
- 5 seats
- up to 25 agents
- RBAC/IAM
- rule distribution
- SIEM feeds to Datadog and Splunk
- priority support within 4 hours
- unlimited seats and agents
- on-premise or GovCloud deployment
- 24/7 SLA
- 1 member and 3 agents (Starter)
- 5 members and 25 agents (Team)
- 50+ members with unlimited agents (Enterprise)
Data, GDPR & hosting
A consolidated view of how Exogram handles your data.
GDPR overview
GDPR handling is documented in detail. Privacy policy v3.2, last updated March 2026, covers EU and UK GDPR alongside CCPA/CPRA. Section 5 sets out the legal bases: contract performance, legitimate interests (infrastructure security, anti-DDoS, billing fraud), legal obligations for accounting and tax, and consent for newsletters. Section 12 lists access, rectification, erasure, portability in JSON or CSV, restriction, objection and non-discrimination, exercised from the account email to privacy@exogram.ai with a 30-day response. Transfers rely on the European Commission's standard contractual clauses plus the UK International Data Transfer Addendum, with AES-256 at rest and TLS 1.3 in transit; the company is headquartered in the United States. Breach notification within 72 hours is promised where GDPR requires it, and a formal DPA is available on request. No Article 27 EU representative is named anywhere on the site.
Who owns the data?
Section 7 of the terms is explicit: as between the two parties, the customer keeps all right, title and interest, including patent, copyright, trademark and trade secret rights, in its data, proprietary rules, custom assertion schemas and agent payloads, together called Customer Data. Exogram receives only a worldwide, non-exclusive, royalty-free license limited to the hosting, analysis, serialization and evaluation needed to run the service. The privacy policy splits the roles accordingly: the customer is the controller and Exogram the processor for execution data, while Exogram acts as controller only for administrative account records such as names, business emails, login identifiers and invoices. Prompts and execution payloads are described as the customer's exclusive property.
Reuse rights
Customers can reuse their own material freely: nothing in the terms requires Exogram's permission, and the privacy policy states that data, prompts and execution payloads remain their exclusive property, exportable in JSON or CSV and deletable at any time through the API or the dashboard. On Exogram's side the declared uses are narrow: evaluating execution payloads in real time, generating chained audit ledgers, authenticating sessions and issuing API keys, enforcing quotas and rate limits, defending against DDoS and credential stuffing, providing technical support and sending mandatory service notices. What is collected covers account details, Stripe payment tokens and billing history with no card numbers stored, the proposed tool calls, parameter keys, state hashes, vault rules and verdicts, plus technical logs such as IP, user agent, referrer, latencies and error codes. The company writes that it does not use customer data, execution traces, prompt inputs, tool arguments, vault assertions, database schemas or cryptographic audit logs to train, retrain, calibrate or fine-tune any foundation model. It states that it sells no personal data, runs no cross-context advertising sharing under CCPA/CPRA, sets strictly necessary cookies only and earns revenue from subscriptions alone. Its trust centre adds a boundary: raw prompts, database records and sensitive payloads stay inside the customer's own environment, while only action intent, tool schemas, constraints, timestamps and capability tokens are evaluated.
Data retention & training
Hosting summary
The multi-tenant SaaS runs in AWS and Cloudflare environments described as SOC 2 audited, with AES-256-GCM encryption and regional residency in the United States and the European Union. The trust centre names the infrastructure sub-processors: Amazon Web Services for cloud and KMS (US-East and EU-Central), Cloudflare for edge, WAF and global anycast, and Supabase Enterprise for encrypted ledger storage on AWS US-East. The privacy policy adds Vercel and AWS for edge functions, CDN and evaluation nodes, Supabase for managed PostgreSQL and authentication, Stripe for payments and Cloudflare for Turnstile and DDoS protection. The company is headquartered in the United States, and transfers may reach the US and the jurisdictions of its cloud providers. Two isolation options exist: a single-tenant dedicated VPC over AWS PrivateLink or VPC peering with customer-managed keys, and an air-gapped sidecar for private Kubernetes or sovereign SCIF environments with fully local evaluation and zero external telemetry. Encryption is AES-256 at rest and TLS 1.3 in transit. A data boundary is also claimed: only metadata and schemas are evaluated, while raw prompts, database records and sensitive payloads stay inside the customer's own VPC.
Where Exogram works
Country-level availability.
Not available in
Things to keep in mind
Risks and trade-offs to weigh before adopting Exogram.
- Compliance vocabulary is easy to over-read: SOC 2 Type II, HIPAA and the EU AI Act are presented as a design alignment meant to support your own audit, not as certifications Exogram holds, and both the SOC 2 report and the penetration test are available only on email request
- Two identities coexist on the site, Exogram LLC in the terms and privacy policy against a footer reading Exogram Inc., while the pricing page's structured data (99 USD and 2.50 USD) contradicts the table it displays (29 USD and 299 USD)
- No postal address is published, only a jurisdiction in King County, Washington State, which makes practical recourse harder to picture
- The contract is unforgiving if things go wrong: no refunds of any kind, liability capped at the greater of twelve months of payments or 100 USD, and mandatory individual arbitration whose opt-out window closes after 30 days
- A guardrail can breed false confidence: the terms themselves disclaim any guarantee that the rules you configure are exhaustive, so a team may quietly relax its own review while believing every dangerous action is covered
- Free-tier audit logs are purged after 30 days, so the evidence you would want after an incident can vanish before anyone goes looking for it
- Every performance and traction figure comes from the vendor and none is independently verifiable, and the company itself is only months old with no archived history, which makes service continuity a genuine risk
Setup & Integrations
Technical difficulty
Installation is easy at every level. The no-code route is one click on the official Custom GPT; Claude Desktop needs a single MCP block, advertised as a ten-second setup; developers run npx exogram init or add one REST call before each tool call. The vendor claims full integration in under five minutes and says the package drops into any Python, TypeScript or MCP project, backed by a Python SDK, an OpenAPI 3.1 specification and a Postman collection. The real difficulty lies elsewhere: writing rules that cover your risks, since the terms disclaim any guarantee of completeness.
Deployment
Integrations
Behind Exogram
Fundraising
Social
Resources
All the official URLs gathered for verification and reference.
Alternatives
Tools that compete with or complement Exogram.
Frequently asked questions
What exactly is the local adaptor?
Do I have to use the cloud dashboard?
What happens when an action is blocked?
How much latency does Exogram add?
Is the free offer a trial?
Is my data used to train AI models?
Is a data processing agreement available?
Which frameworks and assistants does it work with?
How long are audit logs kept?
Can I get a refund?
Should you pick Exogram?
Exogram is a young product with an unusually clear idea of its own place. It does not compete with the models or with the orchestration frameworks; it sits in front of them and decides whether a tool call is allowed to reach a database, a payment API or a file system. That framing is defensible, and the engineering choices follow from it: deterministic rules instead of a second model policing the first, a local adaptor that runs offline, a hash-chained ledger that turns each decision into evidence. For a product whose domain was registered in January 2026, the public documentation is remarkably complete, from an OpenAPI specification and a Python SDK to a fixed catalogue of error codes.
The permanent free plan and the offline adaptor make it genuinely cheap to evaluate: 500 checks a month cost nothing, require no commitment and, on the self-hosted path, expose no data to the vendor at all. Teams already handing autonomous agents real access to production systems are the natural audience, and they can test the premise in an afternoon.
Several things deserve caution before a purchase. The compliance vocabulary is careful but easy to misread: SOC 2 Type II, HIPAA and EU AI Act appear as a design alignment intended to support the customer's own audit, never as certifications Exogram claims to hold. No postal address is published, the site uses two different legal names, and the visible pricing table disagrees with the structured data on the same page. Every performance and traction number is the vendor's own and unverifiable. Above all, the company is only months old with no archived history, so continuity is a live risk. Try it on the free plan, ask for the SOC 2 report and the DPA in writing, and size any commitment accordingly.
- Choosing a selection results in a full page refresh.
- Opens in a new window.