Trust Center
Security is part of how AgentGuards is built, not a checkbox added after the fact. This page is a straight account of where things stand today — including the parts that are still in progress. We'll keep it updated as that changes.
Security practices
Encryption in transit
HTTPS everywhere, with HSTS (max-age 2 years, includeSubDomains, preload) so browsers refuse to downgrade a connection.
Hardened HTTP headers
Content-Security-Policy, X-Frame-Options / frame-ancestors, X-Content-Type-Options, and no X-Powered-By banner disclosing the stack.
Encryption at rest
API keys and other tenant credentials are stored encrypted, not in plaintext.
Per-tenant isolation
Each tenant's configuration, checks, and overrides are scoped independently — one tenant's settings cannot leak into another's.
Safe handling of untrusted patterns
Custom detection patterns you supply are compiled with RE2, not backtracking regex — so a malicious pattern can't hang the engine (ReDoS).
Admin access, fail-closed
Every admin action is gated server-side before it runs. If the caller isn't an authorized admin, the action throws — it never silently no-ops or proceeds.
Data privacy
- Prompts are evaluated and discarded — we do not store prompt content, train on it, or sell it.
- Account data is retained for the lifetime of your account and 30 days after deletion. Usage event data is retained for 12 months. API request payloads are not persisted to long-term storage.
- All infrastructure runs in AWS eu-north-1 (Stockholm) — no data leaves the EU.
Full details, including our sub-processor list, are in the Privacy Policy.
Compliance roadmap
We don't hold formal certifications yet. Here's what we're actively working toward — this list will be updated as each one lands.
Availability
You can check our live health endpoint at any time: prod.agentguards.co/health. This reflects current service health — we don't yet run a separate historical status/incident page.
Responsible disclosure
If you find a security issue in AgentGuards, we want to know. Report it through our contact form with details and steps to reproduce. We ask that you test in good faith — no automated scanning of production without contacting us first, and no attempts to access or exfiltrate data that isn't yours.
We aim to acknowledge reports promptly and will keep you updated as we investigate.
See also our security policy and security.txt.
Need a security questionnaire or DPA?
Happy to fill out a vendor security review or sign a data processing agreement — just get in touch.