Security
Built so your most sensitive documents can live here.
An overview of how AgencyOver protects your data, isolates your tenant, and stays out of the way of your compliance team.
Isolation
Tenant isolation
Every customer gets separate storage, separate embeddings, and separate conversations. No shared indexes, no cross-tenant queries.
Tenant isolation
Separate storage, separate embeddings, separate conversations — your tenant is its own world.
- Per-tenant document buckets
- Per-tenant vector indexes
- Per-tenant chat history
- No cross-tenant queries possible
Encryption
TLS 1.3 in transit, AES-256 at rest. Keys are managed by the cloud provider's KMS, not by us.
- TLS 1.3 in transit
- AES-256 at rest
- Encrypted database backups
- Cloud-provider KMS-managed keys
Access controls
Role-based access with SSO. Admins decide who sees what, down to the record.
- Role-based access (admin / user / super-admin)
- SSO via Google, Microsoft, SAML
- Per-record visibility
- Audit log for sensitive actions
Audit logging
Every document access and every query is logged, exportable, and reviewable by your admins.
- Document access log
- Query log per user
- Admin action log
- CSV export
Model posture
Your data is never used to train shared models. Embeddings stay in your tenant. Zero-retention is available with our LLM provider on Enterprise.
- No shared-model training, ever
- Per-tenant embedding store
- Optional zero-retention with our LLM provider on Enterprise
- Disclosed subprocessors
Compliance roadmap
We're transparent about where we are on the compliance journey.
- SOC 2 Type II in progress
- HIPAA-aligned configurations on request
- DPA available on request
- GDPR data subject requests honored
Subprocessors
Who touches your data
A current list of cloud and AI subprocessors. We notify customers before adding new ones.
| Provider | Purpose | Region |
|---|---|---|
| AWS | Cloud hosting | us-east-1 |
| Supabase | Managed Postgres + storage | us-east-1 |
| Anthropic | LLM provider | us |
| Voyage AI | Embeddings | us |
| Resend | Transactional email | us |
Infrastructure
Cloud-hosted on hardened, audited platforms with encrypted backups and least-privilege access.
- Hardened, audited cloud platforms
- Encrypted, geographically redundant backups
- Least-privilege internal access
- Continuous dependency scanning
Incident response
A documented IR plan with a 24-hour customer notification commitment.
- 24-hour breach notification commitment
- Documented IR plan
- Post-mortem within 5 business days
- Customer notification within 24 hours
- Regular tabletop exercises
Need a DPA, a security questionnaire, or a deeper conversation with your compliance team? We respond within one business day.
Stop searching folders. Start asking your AI.
A 20-minute walkthrough on your documents. No slideware, no scripted demo — your real questions, your real answers.