How AgentMessage protects your data.

This overview is intended to be friendly and readable. It is not the contracted source of truth. For commitments your organization can rely on contractually, the Data Processing Addendum governs, and Annex B (Technical and Organizational Measures) covers our security commitments specifically. Where this page and the DPA differ in detail, the DPA controls.

1. Operating posture

AgentMessage runs as a multi-tenant SaaS on managed cloud infrastructure. Every request, whether from the dashboard, the REST API, or inbound carrier webhooks, is authenticated and scoped to a single organization before it touches data. We default to least privilege, keep the attack surface small, and treat customer message content as sensitive by default. The vendors and infrastructure providers we rely on are listed on our Subprocessors page.

2. Encryption

• In transit. All traffic to AgentMessage, including the marketing site, the dashboard, the API, and webhook delivery, is served over TLS 1.2 or higher. We do not accept plaintext HTTP for authenticated surfaces.
• At rest. Customer data, including message content and metadata, is stored on disk-encrypted volumes managed by our infrastructure providers. Backups are encrypted with the same protection.

3. Tenant isolation

AgentMessage is logically multi-tenant. Every record is tagged with the organization that owns it, and every query path (database, API, and cache) is scoped to the caller's organization. Authorization is enforced at each layer, not just at the edge, so a request authenticated for one organization cannot read or write another organization's data.

We do not offer dedicated single-tenant deployments today. Customers who require physical or infrastructure-level isolation should contact us before contracting so we can discuss whether AgentMessage is the right fit.

4. Authentication and authorization

• User accounts. Dashboard sign-in is handled by Clerk, our identity provider. Multi-factor authentication is available and recommended for all accounts.
• API keys. Programmatic access uses per-organization API keys. Keys are shown once at creation and stored only as a hash. We cannot recover the plaintext, and a leaked key can be revoked immediately from the dashboard.
• Scoping. Both sessions and API keys are bound to a single organization. Internal platform-level privileges are never granted to a customer credential and are applied only at request time for authorized staff.

5. Webhook signing

When AgentMessage delivers events to your endpoints, each request is signed with an HMAC-SHA256 signature derived from a per-organization signing secret. Verifying the signature lets your receiver confirm the payload came from AgentMessage and was not altered in transit. Signing secrets can be rotated from the dashboard without downtime, so you can roll a secret on a schedule or in response to a suspected exposure.

6. Audit and logging

Security-relevant actions, such as authentication, key creation and revocation, and configuration changes, are recorded in an audit log scoped to your organization. Logs are written with credentials stripped and message bodies truncated, so operational and diagnostic logging does not become a second copy of sensitive content. We retain logs long enough to investigate incidents and meet our obligations, and no longer.

7. Retention controls

Message-content retention is configurable. By default we retain content only as long as needed to operate the service, and customers can set a retention window, commonly between 30 and 365 days, by contract. Suppression and opt-out records are kept indefinitely because they protect recipients and are required for compliance. Billing records are retained as required by law. The full, canonical retention schedule is in the Privacy Policy and the DPA.

8. Personnel access

Staff access to production systems and customer data follows role-based access control on a least-privilege, need-to-know basis. Access is logged, reviewed periodically, and revoked promptly when someone changes role or leaves. Routine engineering work does not require access to customer message content; where a support or debugging task does, that access is scoped and audited.

9. Vulnerability management

We keep dependencies current and monitor for known vulnerabilities in the software we ship. We operate a coordinated-disclosure inbox for outside security researchers at security@agentmessage.io. The full scope, reporting process, and safe-harbor terms for good-faith research are on our Security disclosure page.

10. Incident response

We maintain an internal incident-response process for detecting, triaging, containing, and remediating security events. If a personal-data breach affects customer data we process on your behalf, we will notify affected customers without undue delay and, consistent with the DPA, within 72 hours of becoming aware of it, with the information available at the time and follow-ups as the investigation progresses.

11. What we don't have yet

We would rather be honest about gaps than imply certifications we don't hold:

• SOC 2. As of the last-updated date above, AgentMessage has not completed a SOC 2 Type I or Type II examination. We can share more detail about our roadmap under NDA.
• Bug bounty. We accept coordinated disclosure today but do not run a paid bug-bounty program yet.
• Dedicated single-tenant hosting. Not available today (see Tenant isolation above).

12. Reporting a vulnerability

Found a security issue? Email security@agentmessage.io with a description, reproduction steps, and the affected endpoint or component. We will acknowledge your report and work with you on a coordinated timeline. Please review the safe-harbor terms on the Security disclosure page before testing.

13. Get the DPA

Procurement and vendor-security teams that need contracted commitments (GDPR Article 28 processor terms, CPRA service-provider certification, Standard Contractual Clauses, subprocessor change notice, and the full Technical and Organizational Measures in Annex B) should review our Data Processing Addendum. For a countersigned copy or questions about our security posture, email security@agentmessage.io.