Skip to main content
HIPAA compliance is available for Enterprise customers after Exa enables it for your team. Contact sales@exa.ai to discuss Enterprise access, BAA requirements, and enablement.
HIPAA mode is controlled per request with a top-level compliance field:
When this field is present on an eligible team, Exa handles the request with HIPAA compliance controls. If your team is not enabled, the API returns 403 FEATURE_DISABLED. HIPAA mode includes Zero Data Retention for those requests: Exa does not persist PHI.

Supported endpoints

The compliance field is recognized on: Other endpoints reject the field.

Requirements

HIPAA mode supports cached retrieval only. Compatible requests:
  • On /search, set type to instant or fast
  • Request text or highlights (not summary)
  • Use cache-only content: omit freshness fields, or set maxAgeHours: -1 on /contents
Incompatible requests return 400 INVALID_REQUEST_BODY, including:
  • summary on /contents, or contents.summary on /search
  • Freshness settings that require a live fetch, such as maxAgeHours: 0 or a positive maxAgeHours
  • Search requests that omit type, or use a type other than instant or fast

Example

Access

To enable HIPAA mode for your team, contact sales@exa.ai. See the Trust Center for Exa security documentation.
Last modified on August 6, 2026