Security at Agentium
How we protect your data, your agents, and your revenue.
Current security posture
Encryption in transit
TLS 1.3 on all connections. HSTS enabled.
Encryption at rest
Supabase PostgreSQL with AES-256 encryption.
Authentication
Better Auth with session management, CSRF protection, rate limiting.
Rate limiting
Two-layer: Vercel WAF (infrastructure) + Upstash Redis (application). Tiered by user type.
Security headers
X-Frame-Options, X-Content-Type-Options, Referrer-Policy, CSP, HSTS.
Input validation
Zod schemas on all API endpoints. No raw SQL queries (Drizzle ORM parameterizes all queries).
Content safety
NeMo Guardrails — PII detection, harmful content blocking on agent outputs.
Agent evaluation
NeMo Agent Toolkit — automated quality scoring including safety testing for prompt injection.
Webhook security
Stripe signature verification on all webhook endpoints. Idempotency keys prevent duplicate processing.
Status monitoring
5-minute health checks on all services. Public status page at /status.
Compliance roadmap
SOC 2 Type II
Target Q1 2027Audit partner selection in progress
GDPR
CurrentNo EU user data processed for training, deletion requests honored
CCPA
CurrentCalifornia privacy requirements met
HIPAA
Target Q2 2027Required for healthcare agents
ISO 27001
Target Q3 2027Information security management system
Infrastructure providers
Vercel
SOC 2 Type II, ISO 27001
Supabase
SOC 2 Type II, HIPAA eligible
Stripe
PCI DSS Level 1, SOC 1 & 2
NVIDIA
ISO 27001, SOC 2
Agentium's security posture is built on providers with enterprise-grade certifications.
Data handling
- Agentium does NOT train on your data. Agent conversations are logged for performance monitoring only and retained for 90 days.
- Agent invocation data (prompts and responses) is not shared across agents or users.
- Creators cannot access subscriber conversation data.
- Data deletion requests are processed within 30 days per GDPR requirements.
Vulnerability disclosure
If you discover a security vulnerability, please report it to security@agentium.space. We will acknowledge receipt within 24 hours and provide a fix timeline within 72 hours.
Responsible disclosure policy: 90-day disclosure window.
No bug bounty program at this time.
For security questions, compliance documentation, or penetration testing requests, contact security@agentium.space.