Security & Compliance
We handle your clients' most sensitive communications. Here is exactly how we protect that data — no badge-only claims, just specifics.
Our core commitment: Your client data is never used to train our AI models. Ever. What goes into AgencyFlow stays in AgencyFlow.
Encryption
All data is encrypted in transit via TLS 1.3 and at rest using AES-256 block-level encryption.
API keys and OAuth tokens stored in secrets manager — never in plaintext.
Hosting & Data Residency
Infrastructure hosted on AWS Mumbai (ap-south-1), keeping data within India for Indian agencies by default.
Compute and storage are isolated per-tenant — no shared database rows between agencies.
AI Model Training Policy
We do not use your client data to train our AI models. Your emails, client names, deliverables, and communications are strictly confidential.
AI inference runs on isolated, stateless prompts. Nothing from your account persists into model weights.
SOC 2 (Type II)
Our architecture adheres to AICPA Trust Service Criteria: Security, Availability, Confidentiality, and Processing Integrity.
Audit reports available to Enterprise customers under NDA upon request.
GDPR Compliance
For EU-based clients or data subjects, we provide full Data Processing Agreements (DPAs) and support Standard Contractual Clauses (SCCs).
Right-to-erasure (right to be forgotten) deletion workflows are built in and can be triggered on demand.
PHI Stance
AgencyFlow is not designed for Protected Health Information (PHI) workflows. Agencies processing healthcare patient data should not route that data through AgencyFlow at this time.
HIPAA-specific compliance is on our Enterprise roadmap.
Data Retention Policy
Active Account Data
Retained for the duration of your subscription plus 30 days post-cancellation for recovery.
Deleted Account Data
All personal data is permanently purged within 30 days of account deletion request.
Audit Logs
Access and activity logs retained for 12 months for security forensics, then deleted.