Security Pack for Prospects

Comprehensive security and compliance information for enterprise prospects

This Security Pack provides comprehensive information about DataAgents' security posture, compliance alignment, and data protection measures. This document is designed for enterprise prospects conducting security reviews.

Download Security Pack

Download a complete PDF version of this Security Pack for your security review process.

Security Overview

DataAgents implements enterprise-grade security controls to protect customer data:

Encryption: TLS 1.2+ in transit, provider-managed encryption at rest
Access Control: JWT authentication, 2FA available, RBAC, least privilege
Tenant Isolation: Complete logical and physical isolation between customers
Monitoring: Comprehensive audit logging and security monitoring
Incident Response: Documented procedures with 72-hour breach notification
Backup & Recovery: Automated backups with 1-hour RPO, 4-hour RTO

For detailed information, see our Security & Compliance page.

Security Architecture

DataAgents' security architecture implements defense-in-depth with multiple layers of security controls:

Key Architecture Components:

Frontend: React application with HTTPS/TLS encryption
API Gateway: FastAPI with JWT authentication and rate limiting
AI Server: gRPC service with TLS encryption
Database: PostgreSQL with tenant isolation and encryption at rest
Storage: Encrypted object storage with versioning
LLM Providers: Encrypted connections to OpenAI, Anthropic, and other providers

A detailed security architecture diagram is available upon request. The diagram shows tenant isolation boundaries, data flow, encryption points, and storage boundaries without exposing sensitive infrastructure details.

SOC 2 Control Summary

DataAgents implements controls informed by the SOC 2 security and availability criteria. Key controls include:

Security Controls (CC):

CC6 - Access Controls: JWT authentication, 2FA, RBAC, tenant isolation
CC7 - System Operations: Comprehensive logging, monitoring, incident response
CC8 - Change Management: Code review, CI/CD, testing, rollback procedures

Availability Controls (A):

A1 - Capacity Management: Auto-scaling, monitoring, capacity planning
A2/A3 - Backup & Recovery: Automated backups, disaster recovery, restore testing

Note: DataAgents does not hold a SOC 2 certification. We implement and document controls informed by the SOC 2 criteria, and can provide evidence of them on request.

GDPR Guarantees

DataAgents is GDPR compliant and processes personal data in accordance with EU General Data Protection Regulation requirements:

Data Subject Rights: Comprehensive support for all GDPR rights (access, rectification, erasure, portability, etc.)
Data Processing Agreement: DPA available for signing
Sub-Processor Register: Maintained and available upon request
Breach Notification: 72-hour notification procedures
Data Retention: Policies aligned with GDPR requirements
Privacy by Design: Implemented throughout the platform

For more information, see our GDPR & Data Processing Agreement page and Privacy Policy.

Sub-Processors

DataAgents uses the following sub-processors to provide our services:

The full, current list of our sub-processors — what each one does, the data involved and where it is processed — is published on our subprocessors page.

All sub-processors are bound by data processing agreements and security requirements. We maintain a Sub-Processor Register that is available upon request. We will notify customers of any changes to sub-processors as required by our DPA.

Request Additional Information

For additional security information, security questionnaires, or to request specific documentation:

Data Protection Officer / Security Team:
Email: [email protected]
Address: DataAgents, Sophia Antipolis, France

Additional Resources

Security & Compliance Page - Detailed security information
Privacy Policy - How we collect, use, and protect data
GDPR & Data Processing Agreement - GDPR compliance and DPA
Terms of Service - Our terms and conditions

This Security Pack is effective as of January 16, 2026, and is updated regularly to reflect our current security posture and compliance alignment.