Skip to content
Ekso
Start free
TRUST

Security

Last updated 4th September 2026.

Self-hosted by design

Ekso is software you install and operate on infrastructure you control — public cloud, private cloud, or on-premise. We don’t host your install. You choose the database, object storage, network boundary, identity provider, and optional external integrations. Ekso Inc. does not receive your operational data as part of operating the Software.

This page describes the security model of the Software you run, our software-development practices, and the security of the Website (ekso.app) we operate.

What you control

As the operator of your Ekso instance, you control:

  • Data stays home — your database, your blob storage (filesystem, S3, GCS, Azure Blob, or any S3-compatible service), your network boundary.
  • Who has access — you provision users, grant roles, and configure SSO with your identity provider.
  • Backups and disaster recovery — Ekso’s data layer is standard SQL Server or PostgreSQL; your existing backup, replication, and DR practices apply.
  • Encryption at rest — provided by your database and storage of choice (TDE, KMS, etc.).
  • Network exposure — public internet, private network, VPN, and the outbound destinations your team approves.

How regulated environments should assess Ekso

Customer operation changes the data path and can reduce reliance on a hosted vendor. It does not make Ekso, or your deployment, compliant by itself. Your organization remains responsible for scoping, configuring, documenting, assessing, and authorizing the complete system in which Ekso runs.

  • Ekso is not FedRAMP authorized, CMMC certified, or an authorization boundary on its own.
  • Your team determines whether CUI, export-controlled data, ePHI, personal data, or payment data is processed in the deployment and which controls and agreements apply.
  • Connections to AI providers, identity providers, storage, and other integrations follow the destinations you configure and must be included in your data-flow review.

See Compliance context for the boundary and responsibility model we use in procurement discussions.

Authentication and access control

  • Single sign-on via Microsoft Entra ID, SAML 2.0, and OpenID Connect.
  • Two-factor authentication for users not federated through SSO.
  • Role-based access control with granular permissions across tickets, projects, time entries, financials, and administrative functions.
  • Audit logs for sensitive operations — exportable for your SIEM.
  • Password storage uses modern algorithms with per-user salts; passwords are never recoverable, only resettable.

Data in transit

All traffic between Ekso clients (web, mobile, agents over MCP) and your Ekso server is expected to use TLS 1.2 or higher. The Software ships with sane defaults for HSTS, secure cookie flags, and strict transport configuration; final deployment topology is your responsibility.

AI and MCP integrations

Ekso supports bring-your-own AI keys (Anthropic, OpenAI, Azure Foundry, or any compatible provider) and bring-your-own MCP servers. Outbound traffic to AI providers originates from your network and uses your API credentials — there is no Ekso-mediated AI gateway. The boundary you trust is the firewall your security team already operates.

Software development practices

  • Source control — all Ekso source is in private repositories with branch protection and required code review.
  • Dependency management — direct and transitive dependencies are tracked; security advisories are reviewed and addressed in priority order.
  • Static analysis — automated static analysis runs on every change; findings are triaged before release.
  • Release artifacts — Docker images and ZIP bundles are built reproducibly from tagged source. Checksums are published with each release; signed releases are on the roadmap.

Vulnerability disclosure

If you believe you have found a security vulnerability in the Software or the Website, please email sales@ekso.app. We will acknowledge receipt within 2 business days and provide a remediation plan within 10 business days. Please do not publicly disclose vulnerabilities until we have had a reasonable opportunity to address them. We do not operate a paid bug bounty program; we do credit responsible disclosures in release notes when reporters wish to be named.

Security advisories

Critical security advisories are published to all licensees, on every plan, including the free tier. Subscribe to the security feed at ekso.app/blog/rss.xml to be notified.

Website security (ekso.app)

The Website itself is operated by Ekso and runs on Cloudflare Workers with a managed Postgres database on Render. Stripe handles payment processing. Standard practices apply: TLS, HSTS, content security policy, automated dependency updates, and routine review. The Website holds only the personal information described in our Privacy Policy — never any of Your Data.

Reporting an incident

For security incidents, suspected unauthorized access, or vulnerability reports: sales@ekso.app.