Built with accountability.
Operated with care.
How Exohood Labs approaches responsible technology development, privacy, security, AI governance, sanctions and risk across an international ecosystem.
Compliance is a discipline, not a badge
Our approach is risk-based and product-specific. This page does not claim that Exohood Labs or any product holds a licence, certification or external audit that has not been independently established.
Our compliance posture
Exohood Labs develops and researches technologies spanning artificial intelligence, cybersecurity, decentralised infrastructure, real estate technology and digital experiences. Our compliance approach seeks to combine governance, risk identification, responsible engineering and lawful business conduct.
This page describes policies and control objectives, not a certification, licence, audit opinion or representation that every product is authorised in every jurisdiction. Applicable obligations depend on the activity, customer, location and contracting entity.
Governance and accountability
We seek to assign operational ownership for risk assessment, escalation and remediation within each relevant product or engagement. Material legal, security or regulatory issues are assessed and directed to appropriate responsible personnel or advisers.
Different business lines can require different controls. Specific regulatory obligations, oversight structures and approvals are determined for each activity rather than assumed across the entire ecosystem.
Data protection and privacy
Our data-governance approach addresses lawful processing, purpose limitation, minimisation, access control, retention and individual rights. We consider relevant privacy regimes including the UK GDPR, EU GDPR and applicable national laws where they apply.
Privacy terms, roles, transfer arrangements and security obligations for business-customer data may be specified in a separate data-processing agreement. Details for public interactions are in our Privacy Policy.
AI governance and model risk
AI-related initiatives are evaluated with attention to output reliability, system abuse, misuse of sensitive inputs, bias, human oversight, transparency and security. Appropriate controls may include evaluation datasets, safety tests, access segmentation, logging and review procedures.
EU AI Act, UK regulatory guidance and other applicable sector rules may impose distinct obligations for deployed systems. An AI concept, prototype or general-purpose research activity is not automatically a regulated high-risk production service.
Cyber defence and secure development
Cybersecurity activities are designed around threat modelling, secure coding, identity controls, dependency management, vulnerability handling, incident readiness and proportionate testing.
Industry frameworks such as ISO/IEC 27001 and NIST Cybersecurity Framework may inform security design. Mentioning such frameworks does not mean Exohood Labs holds an independently certified ISO credential or has passed a particular external audit.
Financial crime and customer verification
Where a product or transaction is subject to anti-money-laundering, counter-terrorist financing or identity-verification rules, the applicable operator may require customer due diligence, beneficial-ownership information, additional explanations of economic purpose and ongoing transaction review.
KYC and onboarding requirements are service-specific. A wallet connection, website registration or public roadmap description is not evidence of regulatory approval or an approved customer relationship.
Sanctions, restricted users and export control
Our policies prohibit knowing facilitation of unlawful sanctions evasion or prohibited dealings. Screening, jurisdictional restrictions and escalation processes may apply to sensitive transactions, counterparties, technologies or product access.
Export-controlled software, cryptography, dual-use tools or technical data may require authorisations depending on destination, end user, end use and the entities involved. Users must not circumvent restrictions by misrepresentation, unauthorised intermediary accounts or masking their true eligibility.
Digital assets and blockchain obligations
Decentralised technologies can involve public networks and independent counterparties. The regulatory treatment of swaps, wallet services, custody, token issuance or related financial services is determined by the particular activity and location.
Where authorisation is required for a specific regulated service, that service must be evaluated under the applicable framework before it is offered. A general blockchain technology description should not be interpreted as proof that Exohood Labs is authorised as a cryptoasset service provider, exchange, custodian or investment firm.
Third-party dependencies and supplier risk
Third-party infrastructure, analytic technologies, cloud environments, security vendors, external liquidity routes and partners can create operational, privacy and concentration risks. We seek to evaluate material vendors and contractual controls proportionately to the relationship.
Where required, agreements address data-processing instructions, confidentiality, subcontracting, incident cooperation and access to services. Responsibilities vary between the contracting parties and the functions involved.
Incident handling and resilience
Our security governance includes procedures intended to identify, assess, contain and escalate suspected incidents. Depending on the affected service and legal obligations, appropriate steps may include preserving logs, restricting access, coordinating remediation and reporting to authorities or affected individuals.
Business-continuity plans, backups and service restoration goals should be defined according to product risk and contractual needs. No public description here creates a guaranteed response time or zero-incident warranty.
Integrity, anti-bribery and conflicts
Employees, suppliers and business partners are expected to act lawfully and avoid improper payments, deception, concealed beneficial interests and unmanaged conflicts of interest. Suspected misconduct may be escalated for review.
Where an engagement presents a material conflict, controls may include disclosure, recusal, independent review or declining the opportunity. Obligations are applied in accordance with applicable local law and written contracts.
Responsible research and disclosures
Research and product experimentation should be conducted under appropriate permissions, documented boundaries and care for security or privacy impacts. Public technical results may be subject to intellectual property, confidentiality or security restrictions.
Suspected vulnerabilities or serious abuse concerns may be reported via /contact. Testing against systems without permission is not authorised simply because a security research programme is discussed on our website.
Records, evidence and policy review
Depending on a service’s risk level and legal duties, recordkeeping may include documented decisions, contracts, access evidence, incident histories, vendor reviews and training records. Records are maintained and disposed of under applicable retention and confidentiality requirements.
Control frameworks must adapt as products, regulations and threats evolve. This page may be updated to reflect changes in responsibilities, requirements or risk posture.
Regulatory status and external verification
No licence, ISO certification, regulatory registration, independent security audit or supervisory endorsement should be inferred merely from product names, use of technical standards or the existence of this webpage.
Where a specific licence, audited attestation, supervisory status or registration is material to your decision, request current documentary evidence from the relevant contracting entity and verify it with the appropriate issuing authority.
Reporting compliance concerns
For compliance enquiries, suspected misconduct or questions about restrictions, email compliance@exohood.com or use /contact. Do not send passwords, secret keys or highly sensitive evidence over ordinary website forms.
To understand how we handle information submitted in an enquiry, see our Privacy Policy and Email Communications Policy.
Need clarification?
Send your question to the responsible team. We will help identify the applicable service terms, privacy controls or legal contact.