Tenant isolation
Every tenant’s data, agents, and sessions are fully isolated at the database and infrastructure level. Row-level security enforces boundaries even if application code has a bug. Read more →
Security Overview
Security is a first-class concern in AgenFleet’s architecture. Every design decision — from how agents are containerized to how credentials are stored — is made with the assumption that the platform will handle sensitive business operations and client data.
This page summarizes the security posture at a glance. Each area has a dedicated deep-dive page.
Security architecture summary
Section titled “Security architecture summary”Access control
Role-based permissions control what each user can see and do. Tool-level restrictions limit what each agent can invoke. No agent has more access than it needs. Read more →
Audit trails
Every agent action, tool call, and configuration change is logged with a timestamp and actor. Logs are append-only and tamper-evident. Read more →
Data isolation
Agent memory, sessions, and credentials are scoped per tenant and never shared. Credentials are stored encrypted, not in plaintext config. Read more →
Infrastructure security
Section titled “Infrastructure security”Container isolation Every agent runs in its own container with an isolated filesystem, network namespace, and process space. One agent cannot access another agent’s files, memory, or environment variables.
Encrypted storage All data at rest is encrypted using AES-256-GCM. This includes agent memory stores, session history, and credential values.
Encrypted transit All traffic between clients and AgenFleet (portal, API, agent gateway) is encrypted with TLS 1.2+. Internal service-to-service communication is encrypted on the same standard.
Secrets management API keys, credentials, and other secrets are stored in an external secrets vault — separate from the database — and never in plaintext configuration files or logs. Agents reference secrets by name and cannot read the raw credential value.
Infrastructure hardening Servers are hardened with minimal base images, restricted remote access, automated intrusion detection, and firewall rules limiting inter-container traffic to explicitly defined paths. Infrastructure hardening details are available to Enterprise customers under NDA.
Data handling
Section titled “Data handling”What we store
- Agent configuration (model, tools, limits)
- SOUL files and workspace files
- Session history (conversation turns)
- Agent memory store (facts and summaries the agent saves)
- Activity logs (what the agent did and when)
- Cron job definitions and run history
What we don’t store
- Your source systems’ data (agents query and process it; results may be in session history)
- Payment card data (handled entirely by Stripe — PCI compliant)
- Passwords (we use hashed credentials for portal login; SSO providers handle authentication for SSO tenants)
Retention
- Active session history: retained indefinitely until archived by the user
- Archived sessions: retained for 90 days, then permanently deleted
- Activity logs: retained for 1 year
- Deleted agent data: purged within 30 days of deletion
Compliance posture
Section titled “Compliance posture”AgenFleet is designed for enterprise deployment in regulated industries. Current posture:
| Standard | Status |
|---|---|
| SOC 2 Type II | In preparation |
| GDPR | Architecture compliant; DPA available on request |
| CCPA | Compliant |
| HIPAA | Not currently covered; contact us for BAA availability |
Shared responsibility
Section titled “Shared responsibility”AgenFleet operates as part of a broader ecosystem — AI model providers, third-party tool providers, and your own organization each carry distinct responsibilities. Understanding the boundaries is important for compliance, procurement, and incident response.
See the Shared Responsibility Model for a full breakdown of what AgenFleet, model providers, tool providers, and clients are each accountable for.
Responsible disclosure
Section titled “Responsible disclosure”If you discover a security vulnerability in AgenFleet, please report it to security@agenfleet.ai. We review all reports and respond within 2 business days. We do not pursue legal action against researchers who report issues responsibly.