Security & Compliance

Encryption

• All traffic to our website, client portal, and platform is encrypted in transit with TLS 1.2 or higher. Older protocols (TLS 1.0 and 1.1) are refused.
• Data at rest is encrypted with AES-256 by our hosting and database providers.
• Client operational data is additionally encrypted at the application layer with AES-256-GCM, using a separate encryption key for each client. The master key that protects those keys can be rotated without downtime.
• API keys we issue are never stored in plain text — we keep only a one-way keyed hash.

Access control

• Multi-factor authentication is required for every user of the Agentic client portal.
• Two-factor authentication is required for every member of our source code organization.
• Access to production systems is granted through a logged request process, to named individual accounts — no shared logins — and removed when it is no longer needed.
• Each client's data is isolated from every other client's.

Change management

• Every change to our production applications goes through a pull request, and automated tests must pass before it can merge.
• Direct pushes, force-pushes, and branch deletion are blocked on production branches.

Vulnerability management & monitoring

• Dependencies are scanned automatically for known vulnerabilities, with security updates raised as they are published.
• Our public applications are scanned with OWASP ZAP.
• Application errors and service health are monitored continuously, and alerts go to our team in real time.

Incident response

• We maintain a documented Incident Response Plan, approved by management and reviewed every year.
• Automated monitoring alerts our team to errors, failed data writes, and service health problems as they happen.
• If an incident affects your data, we will notify you without undue delay and in line with our contractual and legal obligations.

Infrastructure & data handling

• Our applications and databases are hosted in US data centers (US East).
• Production databases are backed up automatically every day.
• Clients can export everything the portal holds at any time from their account, and download any table or a filtered call list. When an engagement ends, client data is returned or deleted under a documented deletion procedure, within a period set in the agreement; billing and accounting records are retained as the agreement describes. Call audio, transcripts and call logs are also held by our voice-runtime provider, CloneOps, under that provider's own controls and retention.
• We do not sell client data.
• A current list of our subprocessors is available on request.

Where our security information lives

• This page — how we protect client data, and the status of our compliance programs.
• Trust Center — live status of our security controls, monitored continuously in Vanta, and security documents available on request.
• System status — live availability of our public services, with incident and maintenance history.
• Privacy Policy — what personal information we collect and your rights over it.
• Terms of Use — the terms that govern use of this site.
• security@becomeagentic.ai — security questions, questionnaires, and vulnerability reports.

Report a security issue

If you believe you have found a vulnerability in any Agentic system, email security@becomeagentic.ai with the details. Please give us a reasonable chance to fix it before disclosing it publicly. The same address handles security questionnaires and requests for our subprocessor list.