Security
This page is the short version of how we secure the platform, where we are on compliance, and how to report a vulnerability.
How we protect your business
Single sign-on
Your team signs in with their existing Google or Microsoft account, so multi-factor follows whatever your identity provider already requires. SAML, SCIM provisioning and enforced multi-factor are on the roadmap.
Permissions you control
Set exactly who can see and do what, down to individual tools and tasks. Each customer's data stays fully separated from everyone else's, end to end.
Guardrails and approvals
You define the rules and approval steps that govern what the AI is allowed to do. Every action is checked against those rules before it runs, and each decision is recorded.
Reliable automation
Work runs on automation that resumes on its own and never loses progress. Steps pick up exactly where they left off, retries happen automatically, and long-running work survives outages.
Safe hands-on tasks
When the AI needs to operate a desktop app on your behalf, it does so on a machine you add to your workspace, with a full recording of everything it did.
Complete audit trail
Every step is captured as tamper-evident evidence you can review or export. Locked, write-once storage is on the roadmap.
Encryption everywhere
Your data is encrypted in transit and at rest using industry-standard protection. Customer-managed encryption keys are on the roadmap.
Protected infrastructure
The platform runs in a locked-down, private environment with no direct exposure of your data. Credentials are stored in a secure vault and never written to logs.
Working with your security team
- Send us your security questionnaire and we will answer it in full.
- We will walk your team through how Agento handles, stores and protects your data.
- Working with health, payment card or other regulated data? Talk to us first and we will agree the right setup with you.
- Personal information is handled as set out in our Privacy Policy.
Incident response
We operate a 24/7 on-call rotation for production incidents. Customers will be notified of confirmed security incidents affecting their data within the timeframes required by applicable law and our DPA, and in any case without undue delay.
Status: status.agento.au
Vulnerability disclosure
Please report issues to security@agento.com.au. We commit to acknowledging reports within 2 business days, providing an initial assessment within 5 business days, and fixing or mitigating confirmed issues on a timeline proportionate to severity.
We do not currently operate a paid bug bounty programme, but we recognise good-faith research on the same terms as the standard disclosure norms.
Sub-processors
The current sub-processor list is maintained at /trust and updated when it changes.
Trust pack
For procurement or security review, we will answer your security questionnaire, share our sub-processor list and walk your team through the platform. Contact security@agento.com.au.