DATA SECURITY AND PRIVACY

Your data is yours. Your client’s data is theirs. Neither teaches anything to anyone else.

Agencies hold their clients’ budgets, supplier terms and unreleased creative. This page states how that is protected, in plain terms.

TRUSTED DATA STORAGE

Held apart, and held here.

Your own tenant.

Every row carries a tenant identifier, and Postgres row-level security enforces it. The application’s database role cannot bypass those policies, and a migration-time check raises if a tenant-scoped table ships without one.
Residency.

UK, EU and US regions, with London primary. Where your data lives is agreed during onboarding, for what your agency requires.
Encryption.

In transit everywhere; at rest, with customer-managed encryption keys per tenant for stored documents.
Retention and erasure.

Every entity holding personal data has a retention policy and an erasure path, covering both subject access and deletion. Attendee data default-expires after the event, per the agency’s own policy.
No training on your content.

Tenant content never enters a shared model. The model providers behind the agents are used under terms that do not train on your content and do not retain it.

ENTERPRISE-GRADE SECURITY

Your identity, your roles.

Sign in with the Microsoft or Google identity your agency already runs. Roles decide who sees what. Agents act with a named person’s permissions, never more than the person who committed.
Read-only by design.

Agense reads your mail, your files and your calendar. It never holds write access to any of them. Nothing is sent, filed or scheduled by Agense; a person does each of those, under their own name and credential.
Scoped access, on paper.

Access is scoped to the mailboxes you name, with no standing permission in your directory. A connection cannot go live without a signed data processing agreement, a named authoriser and a date on file, and your admin can check what we hold at any time, in your own console.
Access to the platform.

Public surfaces sit behind a web application firewall with per-tenant and per-IP rate limits; file access is via short-lived, scoped, signed URLs. Production access is break-glass, time-boxed and logged.
An append-only record.

Every decision is append-only: who, when, why. Nothing can be edited out of the record.

AI GOVERNANCE

Your data stays yours.

Each agency’s OS learns from that agency’s own work, held under the same row-level security as everything else. There is no live cross-tenant retrieval, and tenant content never enters a shared model or prompt.
The platform only learns through a gate.

Anything that improves Agense for everyone passes an aggregation gate first: input already free of personal data, tenant identity reduced to coarse cohorts, thresholds so no small group can be singled out, and explicit consent tiers. Client-side tenants and anything shared under an engagement grant are excluded from that gate entirely.
We do not trade your data for features.

There is no share-your-data-for-credits option, because that is the bargain this design exists to refuse.
Tenant memory is exportable and deletable.

What your OS has learned is your intellectual property. Erasure cascades: memory derived from deleted source content is purged with it.
Every draft is reproducible.

Model calls go through one gateway, and the context behind each draft is logged with artefact versions and memory references. Prompt and response logs are tenant-scoped and redacted.
Agents draft; humans commit.

Supplier commitments, client-facing financial commitments and event-safety sign-offs always route through a named person’s approval. Attempts to bypass it are a required test category.

THE QUESTIONS YOUR IT LEAD WILL ASK

Is it secure?

Each agency runs in its own tenant. Projects, files, correspondence and what your OS has learned are isolated at the data layer, under keys of your own.
Encrypted in transit and at rest.
Sign in with the Microsoft or Google identity your agency already runs. Roles decide who sees what. Agents act with a named person’s permissions, never more than the person who committed.
Agense reads your mail, your files and your calendar. It never holds write access to any of them. Nothing is sent, filed or scheduled by Agense; a person does each of those, under their own name and credential.
Access is scoped to the mailboxes you name, with no standing permission in your directory. A connection cannot go live without a signed data processing agreement, a named authoriser and a date on file, and your admin can check what we hold at any time, in your own console.
Every decision is append-only: who, when, why. Nothing can be edited out of the record.

Could our work end up helping another Agense customer?

No. Tenant content never enters a shared model. What your agency’s OS learns stays in your tenant, and is yours to export or delete.
The model providers behind the agents are used under terms that do not train on your content and do not retain it.
Your prompts, drafts and files are yours. So is the record of every decision.

Is it compliant?

UK GDPR and EU GDPR. Your agency is the controller; Agense is the processor, under a data processing agreement. Your clients’ data flows only under your own contracts with them. No connection goes live without the agreement signed.
Data held in the UK, the EU or the US, agreed during onboarding for what your agency requires.
Sub-processors listed and changes notified. Data-subject requests and erasure supported within the statutory windows; retention set by you.
If something goes wrong, you hear from us without undue delay, within 72 hours, with what happened and what we did.

How do I report a vulnerability?

Write to security@agense.io before disclosing publicly. We will acknowledge, keep you updated, and credit you if you would like us to.

Thirty minutes covers what this page does not: your questions, a security questionnaire, a data processing agreement or a procurement review.

Registered with the Information Commissioner’s Office: ZC223641.