Exa (exa.ai)

Independent Sources

Shown for context — not merged with USAComplaints' own numbers.

Contacts, Payment & Login

• Official website: https://exa.ai/
• Support: product questions, problems, feedback: [email protected]
• Billing: payments, credits, invoices (Exa billing docs): [email protected]
• Terms contact: account, subscription cancellation, arbitration opt-out: [email protected]
• Contact sales form (plans, pricing, enterprise contracts): https://exa.ai/contact/sales
• Sales and Enterprise: zero data retention, HIPAA mode: [email protected]
• Privacy questions or concerns (Privacy Policy): [email protected]
• Security reports and Trust Center contact: [email protected]
• Press inquiries: [email protected]
• Contact in CalPrivacy data broker registry entry: [email protected]
• API dashboard (sign-in, API keys, usage): https://dashboard.exa.ai/
• Billing dashboard (add credits, auto recharge, invoices): https://dashboard.exa.ai/billing
• Status page (incidents and uptime): https://status.exa.ai/
• Trust Center (SOC 2 report access, DPA, subprocessors): https://trust.exa.ai/
• ExaSearchBot crawler information and controls: https://crawler.exa.ai/
• Phone in SEC filer record and CalPrivacy registry (not on Exa's site): 628-250-3948
• BBB-listed phone for the 'Exa AI' profile: (415) 767-1409

Locations

Credits, billing, refunds, disputes, privacy requests and site-owner controls: what Exa's own pages say

Exa is a business and developer product: its own pages describe a web search API for AI applications and agents, sold with a free tier and prepaid pay-as-you-go credits. The routes below come from Exa's own pages, opened on October 4, 2026. Where two Exa pages differ, both are shown.

Pricing and credits. Exa's pricing page lists three plans. Starter (Free) offers "$10 credits every month plus a $10 onboarding bonus. No payment method required". Developer (Pay as you go) lists "PAYGO usage-based billing" and "Pay via card or bank account". Enterprise (Custom) lists "Custom MSA and DPA", "Zero data retention", "Monthly invoicing" and "Enterprise SLAs". The page's endpoint table gives base prices per 1,000 requests (up to 10 results): Instant search $4, Fast or Auto search $7, Deep search $12, Deep-Reasoning search $15, Answer $5 and Monitors $15; Contents is $1 per 1,000 pages per content type, and results above 10 cost $1 per 1,000 on the search endpoints. Exa Agent runs cost $0.012 to $1.00 depending on a fixed effort level, or are usage-based at the Auto and Ultra levels; Exa's pricing documentation says metered runs bill actual usage up to a per-run cap, with "auto" defaulting to a $5 cap and "ultra" to a $20 cap. The page also says: "By default, Agent uses effort: auto. Compute and tool usage scale to the task. Choose a fixed effort mode for predictable per-request pricing." Exa's pricing documentation adds: "Exa is pay-as-you-go. There is no subscription and no minimum spend: you load credits and are charged per request."

Billing mechanics. Exa's Billing and Rate Limits documentation says requests are charged against prepaid credits, payments are processed through Stripe, receipts for credit purchases and auto recharges are emailed from [email protected], and the invoice history is in the Billing dashboard. Auto recharge buys credits when a balance reaches a threshold the team chooses, in amounts from $5 to $10,000, with an optional monthly maximum ("Set it to $0 or leave it blank for no cap"). When credits run out, "requests return 402 Payment Required"; an API key that reaches its assigned budget also returns 402, and the error-code page lists NO_MORE_CREDITS, API_KEY_BUDGET_EXCEEDED and TEAM_BUDGET_EXCEEDED. Exa's pricing documentation says "auto defaults to a $5 cap; ultra defaults to a $20 cap". Exa's changelog of September 24, 2026 says Agent Ultra runs are "billed at standard Agent usage rates, up to a default $20 per run", adjustable with budget.maxCostDollars.

Cancelling and refunds: two Exa pages, both quoted. Exa's Terms of Service (a PDF linked from exa.ai/terms; its extracted text shows no "Last Revised" date) say in section 2.2 that paid Services "will be charged on a recurring subscription basis" and in section 2.3 that a subscription "will automatically renew at the subscription period frequency referenced on your subscription page (or if not designated, then monthly)". Section 2.3 continues: "To avoid future subscription charges, you must cancel your subscription 0 days before the subscription period renewal date by doing the following: going to https://dashboard.exa.ai/plan or contacting [email protected]." Section 2.4 says "payments for any subscriptions to the Services are nonrefundable and there are no credits for partially used periods", with access continuing to the end of the paid period. Section 2.2 also reserves the right to "change our subscription plans or adjust pricing for the Services in any manner and at any time", with changes taking effect "following reasonable notice". Exa's billing documentation, by contrast, describes prepaid credits and auto recharge rather than subscriptions, and says free credits "are never paid out or refunded". The pages opened do not state a refund policy for purchased prepaid credits or for an auto-recharge purchase made in error, and they do not describe how to switch auto recharge off beyond saying it is configured from the Billing dashboard. For billing questions, Exa's documentation names [email protected] ("Get help with payments, credits, invoices, or account billing questions") and the Terms name [email protected]. The Terms also say that services bought under a Master Subscription Agreement or other agreement are governed by that agreement if it conflicts with the Terms.

If a dispute is not resolved. Section 8 of the Terms asks each side first to "make a good faith sustained effort" to resolve a dispute informally, allowing the other side thirty days to respond. Remaining claims go to individual binding arbitration administered by JAMS, with a class-action waiver. Section 8.6 allows an opt-out of the arbitration provisions by written notice to [email protected] "within thirty (30) days of your first registering to use the Services or agreeing to these Terms"; an opt-out of arbitration alone does not remove the class-action waiver. Section 8.4 sends three kinds of claim to court instead: individual small-claims matters, claims seeking only injunctive relief, and intellectual-property claims. California law governs, with San Francisco state and federal courts as the venue if arbitration does not apply (section 10.8). Section 10.6 of the Terms tells California residents they may report complaints to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs, 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210; that is the company's own statement, and the agency's current contact details were not separately checked. Section 7.2 limits the company's total liability for damages finally awarded to the greater of $100 or the amount paid in the past six months for the services giving rise to the claim. These are contract terms, not findings about how any dispute was handled.

Rate limits, errors and blocked access. Exa's documentation lists default limits of 10 queries per second for /search, /answer and /chat/completions (5 for deep search types), 100 for /contents and 50 active Agent runs; adding $1,000 in credits within 30 days raises the team's limit to 25 queries per second for 90 days. Exceeding a limit returns 429. Exa's Security overview says it "blocks API access from sanctioned or otherwise restricted countries and regions, including Crimea, Cuba, Iran, North Korea, Russia, Syria, Ukraine, and Venezuela", and tells anyone who believes their traffic is geolocated incorrectly to contact [email protected] with the source IP, country or region, request time and Cloudflare Ray ID.

Contacts Exa publishes. Exa's Contact page lists [email protected] for product questions, problems and feedback, a contact-sales form, and [email protected]. Other role addresses appear in Exa's documents: [email protected] (billing help), [email protected] (Enterprise features such as zero data retention and HIPAA mode), [email protected] (Privacy Policy), [email protected] (vulnerability reports) and [email protected] (Terms). No customer-service phone number appears on the Exa pages opened.

Service status. Exa's status page (status.exa.ai) showed "All systems operational" on October 4, 2026, with 90-day uptime figures of 99.97% (Search API), 99.99% (Websets), 100.0% (Exa MCP) and 99.92% (Agents API). Its notice history lists seven notices dated August 14 to September 22, 2026 (the page shows clock times in the viewer's local time zone, so only dates are given here), including a brief Search API error period on August 14 that Exa's update says was resolved with "no data loss", "Agent runs failing to start" on September 18 (labelled Major outage, 25 minutes), and "Elevated failures affecting Agent runs" on September 22 (labelled Partial outage, 4 hours 56 minutes), which Exa's update says was isolated to "a service-side capacity constraint". A separate incident page, "API outage", labelled Major outage and dated July 24, 2026, states an impact window of 10:58 to 11:14 UTC (16 minutes) and, in Exa's words, that the "Exa API is fully operational again". The Enterprise plan lists "Enterprise SLAs"; no SLA or service-credit terms were found in the pages opened.

If you are asking about personal information. Exa's Privacy Policy gives [email protected] as the contact for "any questions or concerns regarding this Privacy Policy or our privacy practices"; the policy text opened does not describe a procedure for access or deletion requests, apart from a sentence saying a parent or guardian of a child under 13 may contact Exa to request that the child's information be deleted. Exa's California Privacy Disclosure (last updated July 1, 2026) tabulates requests from January 1 to December 31, 2025: for "Delete personal information", 49 received, 5 complied with in whole or in part, 0 denied, with a mean response time of 1.99 days; for "Opt out of sale / sharing", 1 received, 0 complied with, 0 denied. It adds that "Requests are denied when we are unable to verify the identity of the requestor". California residents can also use the state's Delete Request and Opt-out Platform (DROP) at privacy.ca.gov/drop. The DROP page says that starting August 1, 2026 data brokers "must access DROP at least once every 45 days to begin processing deletion requests" and that "it could take up to 90 days to see your status updated in DROP", with timing varying by data broker; Exa Labs Inc. appears in the state's data broker registry file (see the company background).

If you run a website. Exa's crawler page (last updated July 30, 2026) says its robot is ExaSearchBot (user agent "Mozilla/5.0 (compatible; ExaSearchBot/1.0; +https://crawler.exa.ai/)"), that it respects robots.txt, and that a site can block it with a robots.txt group such as "User-agent: ExaSearchBot / Disallow: /". Because robots.txt controls crawling, not indexing, the page says to use a noindex robots meta tag or an X-Robots-Tag: noindex header to remove a page already indexed; "ExaSearchBot drops the page after it next re-fetches it". Questions go to [email protected], ideally from an email address at the domain concerned. On verifying the crawler, the page says "User-agent strings can be spoofed, so don't trust the string alone" and that every ExaSearchBot request is cryptographically signed using HTTP Message Signatures (RFC 9421) under the Web Bot Auth scheme, with Ed25519 public keys published at crawler.exa.ai/.well-known/http-message-signatures-directory; it says providers that support Web Bot Auth, such as Cloudflare and Akamai, validate the bot at the edge automatically.

Company background

Who operates Exa. Exa's Terms of Service name Exa Labs, Inc. as the provider of exa.ai, its search engine and API; the Privacy Policy says "we, Exa Labs Inc." and gives 430 Shotwell Street, San Francisco, CA 94110 as the address. SEC EDGAR lists Exa Labs Inc. (CIK 0002024864) with state of incorporation DE and the same Shotwell Street business address. BBB's separate profile, named "Exa AI", gives 375 Alabama St, Ste 410, San Francisco, lists the website exa.ai and names "Mr. Will Bryk, Owner"; this page does not reconcile the two addresses. Exa's About page lists Will Bryk as CEO and Jeff Wang as co-founder.

History. Exa's blog post of January 25, 2024 says "we're renaming Metaphor to 'Exa'". Its post of September 3, 2025 says "We started Exa in 2021" and that the first search engine launched in November 2022; Y Combinator's company page lists the Summer 2021 batch. BBB's raw page data gives a business-start date of 2017-12-16 and a file-opened date of 2025-08-14, which differ from the company's own account. Exa announced its first Asia office, in Singapore, on March 30, 2026.

What it sells. Exa's pages describe a Search API, a Contents API for known URLs, an Agent API for asynchronous research and list-building, Monitors for scheduled searches, Websets, an MCP server and Exa Connect, which lets Exa Agent query third-party data providers. Its documentation says it operates a web index and also lists company, people and scholarly-publication data categories. On April 28, 2026 Exa said Google had released "Grounding with Exa Web Search" in Private Preview and that Exa Agent was available in Gemini Enterprise's Agent Marketplace.

Funding and size, as the company states them. Exa's blog says it announced $22M of seed and Series A funding on July 16, 2024 (led by Lightspeed Venture Partners), an $85M Series B on September 3, 2025 (led by Benchmark, at a $700m valuation) and a $250M Series C on May 20, 2026 (led by a16z, at a $2.2B valuation). The May 2026 post says Exa powers search for Cursor, Cognition, HubSpot, OpenRouter and Monday.com and that more than 5,000 companies use it. SEC EDGAR shows three Form D notices of exempt offerings for Exa Labs Inc., filed on March 4, 2025, March 11, 2026 and September 28, 2026; the latest, signed by William Bryk on September 25, 2026, reports a date of first sale of May 15, 2026, $247,488,419 offered and sold, and 38 investors. A Form D is a company-prepared notice, not an SEC review of the business. Customer, developer and valuation figures are the company's or its investors' statements and were not independently verified.

Data use and retention. Exa's Privacy Policy (last updated June 29, 2026) says of search queries: "Query Data is used to improve our products and technology, including by training and fine-tuning models that power our Services", and that Exa does "not actively monitor query data for personal information". The same policy says it "does not apply to content or other information that we process on behalf of customers of our business offerings", which is "governed by the relevant customer agreements". The pages opened do not say in so many words whether the training statement applies to queries sent through the API on the free or pay-as-you-go plans, and they state no default retention period; Enterprise customers can ask [email protected] about their agreement. Exa's Terms of Service, section 1.2(c), also state: "You grant us a nonexclusive, royalty-free, transferable, sub-licensable, worldwide, perpetual and irrevocable license to access, use, host, cache, store, reproduce, transmit, display, publish, distribute, and modify any User Input and Output as needed to provide, develop and improve upon our products and services, including the Services, and to otherwise permit access to or disclose your User Input or Output to third parties as needed to accomplish the foregoing or as necessary to comply with our legal obligations." The Terms also say that an agreement signed for a paid plan governs if it conflicts with them. Exa's documentation says Zero Data Retention "is available on Enterprise plans and enabled per team": available for Search, Contents and Agent, and "Not currently supported" for Answer and Websets. HIPAA mode is also an Enterprise feature, set per request, and Exa's HIPAA page says that it "includes Zero Data Retention for those requests: Exa does not persist PHI".

Security and compliance statements. Exa's Trust Center says its systems are "audited under SOC 2 Type II for security, confidentiality, and availability" with the report available on request, and lists a file named "Exa Labs Inc. HIPAA Attestation 2026-06-17.pdf", a 2026 SOC 2 bridge letter, a Data Processing Addendum, a penetration testing report and a subprocessor list. The reports themselves require an access request and were not read for this page. Exa also publishes a vulnerability disclosure policy with a bug-bounty range of $25 (low) to $1000-$5000 (high) and [email protected] as the contact.

Data broker registration and people data. The California Privacy Protection Agency's downloadable Data Broker Registry file (registry.csv, opened October 5, 2026) contains a row for "Exa Labs Inc." with the doing-business-as name "Exa", website exa.ai, contact email [email protected] and the Shotwell Street address. The registry page says the businesses in it "operated as data brokers in 2025"; the page's own count text, as returned to a text fetch, reads "0 data brokers registered", so this page relies on the CSV row and not on the rendered table. Exa's privacy policy lists "Information from publicly accessible sources, including names, job titles, company affiliations" among the information it obtains, and its documentation describes searching for people and companies. A registry listing is a registration, not an enforcement finding.

Recent changes seen in the sources. Exa's changelog records a pricing update on March 3, 2026 ("We simplified and lowered pricing"), the retirement of the legacy /research endpoint on April 1, 2026 (replaced by deep-reasoning search) the Agent Ultra launch (changelog entry of September 24, 2026; blog post of September 25, 2026) and a blog post of September 17, 2026 introducing Exa Snapshot, which the post describes as a way to search the web as it was at an earlier date. The Privacy Policy was last updated June 29, 2026 and the California Privacy Disclosure on July 1, 2026.

Other companies with similar names. ExaGrid (exagrid.com, "Tiered Backup Storage" on its home page) and EXA Infrastructure (exainfra.net, "Owned Fibre & Subsea Network") are separate businesses with their own websites; nothing in the pages opened links either to Exa Labs Inc. Exa's own pages use exa.ai and subdomains such as dashboard.exa.ai, status.exa.ai, trust.exa.ai and crawler.exa.ai; its vulnerability policy lists "Phishing websites, proxies, discord bots, and other 'free' websites which provide access to the product" as out of scope.

Complaint record: USAComplaints posts, BBB and Trustpilot, as displayed on October 4, 2026

USAComplaints posts. As of October 4, 2026, USAComplaints has no published complaint posts about Exa, so no complaint themes are shown. The figures below come from outside sites, are shown as displayed on October 4, 2026, and are not added together or averaged.

BBB. BBB has a profile named "Exa AI" (category Artificial Intelligence) at 375 Alabama St, Ste 410, San Francisco, which lists the website exa.ai. It says "This business is NOT BBB Accredited" and shows a BBB rating of A+. The complaints tab says "This business has 0 complaints" and the reviews tab says "This business has 0 reviews". BBB's raw page data gives a file-opened date of 2025-08-14 and a business-start date of 2017-12-16. The profile was found by searching "exa.ai" near ZIP code 94110; a search for "Exa Labs" near San Francisco and a nationwide search for "Exa Labs Inc" did not list it. BBB says it does not verify the accuracy of information provided by third parties.

Trustpilot. Trustpilot's page for exa.ai is titled "EXA Reviews | Be the first to review exa.ai". It is marked "Claimed profile" with "July 2025" shown beside it, and displays 0 reviews and a score of 0.0, so it provides no review sample.

Other sites. A ComplaintsBoard site search for "exa.ai" returned two companies unrelated by name and a search for "Exa Labs" returned "No reviews matching", so no ComplaintsBoard page for Exa was found on October 4, 2026.

Service status. Exa's own status-page notices, which are operational records rather than customer complaints, are described under "Service status" in the first section of this page.

Is Exa (exa.ai) Legitimate?

Facts checked on October 4, 2026: Exa's Terms of Service and Privacy Policy name Exa Labs, Inc. as the operator of exa.ai; SEC EDGAR lists Exa Labs Inc. as a Delaware-incorporated filer at 430 Shotwell Street, San Francisco, with Form D notices filed in March 2025, March 2026 and September 2026; the California Privacy Protection Agency's data broker registry file lists Exa Labs Inc. at the same address; and BBB has a profile for the exa.ai website (described in the complaint-record section). Exa publishes its Terms, a Privacy Policy and California disclosure, a Trust Center, a vulnerability disclosure policy, a status page and a crawler page, and its Terms and billing documentation set out the charging, renewal and dispute rules summarized above.

What the sources checked did not show: no government enforcement action, court case or data-breach notice naming Exa Labs or exa.ai was identified in the sources checked on October 4, 2026. Those sources were a CourtListener RECAP search for the phrase "Exa Labs" (0 results, run in a browser on October 4 and again on October 5, 2026; only that one phrase was searched); the California Attorney General's data security breach list export (5,346 entries, the latest reported on 10/02/2026), in which no organization name contained "Exa" as a word, "Exa Labs" or "exa.ai"; BBB National Programs site searches for "exa.ai" and "Exa Labs" (0 results each); the BBB profile's complaints tab (0 complaints); and a ComplaintsBoard site search (repeated on October 5, 2026 with the same result). The FTC's site search could not be used, and other state regulators, other states' breach lists, state courts, arbitrations and sealed matters would not appear in these sources, so this is not a complete search.

What this page cannot confirm: the SOC 2 and HIPAA reports and the Data Processing Addendum listed in the Trust Center were not read; the customer, developer, funding and valuation figures are company or investor statements; and Exa's contract terms, including its arbitration clause and liability cap, are described but not evaluated here. A registration, such as the data broker registry listing or a Form D, is not an approval or a finding by the agency that holds it.

Frequently Asked Questions