Security
Built so your most sensitive documents can live here.
An overview of how AgencyOver protects your data, isolates your tenant, and stays out of the way of your compliance team.
Isolation
Tenant isolation
Every customer gets separate storage, separate embeddings, and separate conversations. No shared indexes, no cross-tenant queries.
Tenant isolation
Separate storage, separate embeddings, separate conversations — your tenant is its own world.
- Per-tenant document buckets
- Per-tenant vector indexes
- Per-tenant chat history
- No cross-tenant queries possible
Encryption
TLS 1.3 in transit, AES-256 at rest. Keys are managed by the cloud provider's KMS, not by us.
- TLS 1.3 in transit
- AES-256 at rest
- Encrypted database backups
- Cloud-provider KMS-managed keys
Access controls
Role-based access, scoped to your tenant. Admins decide who can see and do what, and sensitive actions are logged.
- Role-based access (admin / user / super-admin)
- Microsoft 365 / Entra SSO (per tenant)
- Strict tenant isolation on every query
- Audit log for sensitive actions
Audit logging
Every document access and every query is logged, exportable, and reviewable by your admins.
- Document access log
- Query log per user
- Admin action log
- CSV export
Model posture
Your data is never used to train shared models. Embeddings stay in your tenant. Zero-retention is available with our LLM provider on Enterprise.
- No shared-model training, ever
- Per-tenant embedding store
- Optional zero-retention with our LLM provider on Enterprise
- Subprocessors disclosed on request
Compliance roadmap
We're transparent about where we are on the compliance journey.
- SOC 2 Type II in progress
- DPA available on request
- GDPR data subject requests honored
Infrastructure
Cloud-hosted on hardened, audited platforms with encrypted backups and least-privilege access.
- Hardened, audited cloud platforms
- Encrypted, geographically redundant backups
- Least-privilege internal access
- Continuous dependency scanning
Incident response
A documented IR plan with a 24-hour customer notification commitment.
- 24-hour breach notification commitment
- Documented IR plan
- Post-mortem within 5 business days
- Customer notification within 24 hours
- Regular tabletop exercises
Need a DPA, a security questionnaire, or a deeper conversation with your compliance team? We respond within one business day.
Stop searching folders. Put your AI to work.
A 20-minute walkthrough on your own documents and your own book. No slideware, no scripted demo — your real questions, your real answers, and the follow-up work it can tee up for you.