---
title: "Security"
description: "Rex runs accounts receivable workflows inside customer finance systems. This page covers security posture, vulnerability disclosure, and how Rex uses and secures AI."
canonical: https://www.rex.inc/security
last-updated: 2026-08-21
---

# Security

Rex runs accounts receivable workflows inside customer finance systems. This page covers security posture, vulnerability disclosure, and how Rex uses and secures AI.

## Certifications

Rex is SOC 2 Type II certified. Reports, subprocessors, and the current security posture are published at the [Trust Center](https://trust.rex.inc/).

## Security posture

Each customer operates in a fully isolated environment. Data, policies, and agent context are scoped per-tenant. Rex runs on AWS. Authentication is handled via WorkOS with support for enterprise SSO.

Further measures, including encryption, access control, and incident response: [Privacy Policy](https://www.rex.inc/privacy-policy) and [Data Processing Agreement](https://www.rex.inc/data-processing-agreement).

## Vulnerability disclosure

Report suspected vulnerabilities to [security@rex.inc](mailto:security@rex.inc). Include a description, the system affected, and steps to reproduce. Give Rex a reasonable opportunity to investigate and fix the issue before any public disclosure. Do not access other customers' data, disrupt the service, or use social engineering.

The same contact is published at https://www.rex.inc/.well-known/security.txt.

## How Rex uses and secures AI

Rex uses Anthropic's Claude models for all LLM inference, accessed via AWS Bedrock. Rex does not train, fine-tune, or host its own models. All inference runs server-side. End users never interact with the model directly. Every request is scoped to a single tenant.

Customer data is used at inference time to perform work within that tenant. Operational data is retained for the duration of the contract. Tenant data is not used to train or fine-tune models. Actions can be surfaced for human review, and every action includes a decision trace.

## Further reading

- Full page: [Security](https://www.rex.inc/security)
- [Trust Center](https://trust.rex.inc/)
- [Privacy policy](https://www.rex.inc/privacy-policy)
- [Contact](https://www.rex.inc/contact)