Security Policy

At AiSentr, security is the highest priority. From how your data is handled, to how users are managed, everything is designed to keep your information safe, private, and under your control. Our platform is built so businesses can confidently use AI agents, without sacrificing security or compliance.

How the Platform Works

AiSentr is designed to provide peace of mind while delivering powerful AI driven workflows.

• Agents respond only to authorised data – Every answer an agent gives is limited to the data sources the user has been granted access to.

• Private environments – Each AiSentr customer has a fully isolated environment. No customer data is mixed, shared, or visible to another.

• Controlled by administrators – Customer administrators manage users, roles, permissions, and integrations to ensure only the right people and tools are enabled.

• Your data stays with you – Unless explicitly shared, your content remains invisible to AiSentr staff, other customers, or unauthorised users.

This model ensures that customers maintain complete ownership and control of their information.

Your Data Is Inherently Secure

AiSentr treats every customer’s environment as a sealed container.

• Privacy by default – We never share your data with external AI models, public services, or other customers without your permission.

• Strict isolation – Projects and agents are fully separated. This prevents accidental cross-learning or data exposure between customers.

• No public visibility – Conversations, workflows, and training data remain private to your organisation.

• Deletion on demand – You may permanently delete your data at any time. Once deleted, AiSentr cannot access or recover it.

This ensures your information remains confidential and protected throughout its lifecycle.

How Your Data Is Handled

Our approach to data management is based on transparency and control:

• Storage – Data is stored in isolated containers. The region you choose (U.S., U.K., or otherwise) determines where it resides, supporting compliance and performance needs.

• Cloud infrastructure – We host on Tier-1 providers such as AWS and Azure, leveraging their enterprise-grade security and redundancy.

• Deletion & export – You can delete data from within your account at any time. Data can also be exported in formats such as JSON or CSV before deletion.

• Retention policies – Operational logs and backups follow strict retention schedules. These are automatically purged after set periods unless you request earlier deletion.

Identity & Access Controls

Access to your environment is tightly managed to follow the principle of least privilege.

• Authentication – We support enterprise login standards such as SAML, OAuth2, and Multi-Factor Authentication (MFA).

• Role-based access control (RBAC) – Permissions are assigned by role, ensuring users only see the data and tools they are authorised for.

• Fine-grained access (FGA) – Enterprise customers may enforce additional controls to limit access more precisely at the dataset or agent level.

• Directory integration – Active Directory, LDAP, and identity provider syncs are supported, making it easier to enforce company-wide security policies.

• Restricted staff access – AiSentr staff cannot access your content by default. Any access is subject to explicit approval and logged for audit purposes.

• Project isolation – Projects are completely separate; users cannot access another project unless added by a customer administrator.

Third-Party Integrations & Sub-processors

AiSentr integrates with external platforms without compromising security.

• Customers choose which integrations (e.g., Google Drive, OneDrive, Slack, Teams) to enable.

• Secure OAuth2 and scoped API tokens ensure only minimal, necessary data is exchanged.

• All integration activity is logged for visibility.

• We vet third-party vendors before onboarding, requiring them to meet our security standards and compliance obligations.

• Sub-processors are regularly reviewed, and their access is revoked if no longer required.

Certifications, Audits & External Assurance

AiSentr’s security practices are aligned with international standards:

• ISO 27001 – We follow the ISO framework through an Information Security Management System (ISMS).

• SOC 2 Type II – Independent auditors validate our controls for security, availability, confidentiality, integrity, and privacy.

• GDPR compliance – For customers in the EU, our systems and contracts align with GDPR obligations.

• Independent testing – External specialists conduct penetration tests and security assessments at least annually.

• Enterprise access – Customers may request audit reports and compliance documentation under NDA.

Business Continuity & Disaster Recovery (BC/DR)

We are committed to reliability and resilience.

• High availability – Our systems are designed to minimise downtime, with redundancy across zones and regions.

• Secure backups – Data is encrypted, replicated across secure locations, and regularly tested for recoverability.

• Documented response plans – Disaster recovery and business continuity plans define steps, responsibilities, and escalation paths in case of an incident.

• Periodic testing – Plans are rehearsed to ensure effectiveness, and improvements are made after each test.

Risk, Monitoring & System Hardening

Security is an ongoing process.

• Monitoring – We continuously monitor systems for threats, anomalies, and intrusion attempts.

• Vulnerability management – Automated scanning and prompt patching address emerging risks quickly.

• Endpoint protection – Malware defense and endpoint security tools are enforced across employee devices.

• Training & awareness – All employees undergo annual security training and must sign confidentiality agreements.

• Risk register – We maintain a live register of risks, threats, and mitigations, updated through regular reviews.

• Audit trails – System logs and activity records are preserved for compliance and forensic purposes.

Encryption & Key Management

Encryption underpins AiSentr’s security architecture.

• In transit – All data exchanged with AiSentr is protected using TLS 1.2 or higher.

• At rest – Data, including backups, is encrypted with AES-256.

• Key management – Encryption keys are managed by secure cloud services, rotated regularly to reduce risk.

AI Agent Safety & Governance

We take additional measures to protect the way AI agents interact with data.

• Controlled access – Customers decide which datasets agents may use.

• Sensitive data handling – Options exist to mask or scrub personally identifiable information (PII).

• Prompt injection protection – Agents are hardened against malicious or unintended instructions.

• Auditability – Agent actions are logged, with review trails for compliance.

• Human oversight – Approval workflows can be enabled to keep humans in the loop when required.

Network & Isolation Security

Our network design protects against unauthorized access and lateral threats.

• Segmentation – Customers operate in logically separated virtual networks.

• Firewalls & controls – Firewalls, rate limits, and strict traffic rules are in place.

• Service isolation – Micro services are containerised and operate with scoped permissions.

• Continuous monitoring – Network traffic is analysed in real time to detect anomalies.

Data Residency, Ownership & Deletion

We believe your data belongs to you, not to us.

• Residency options – Customers choose where their data is stored to meet compliance and performance needs.

• Tenant isolation – Each customer’s environment is fully separate, preventing unauthorised cross-access.

• Ownership – Customers retain full ownership of their uploaded content.

• Export support – Data can be exported in multiple formats on demand.

• Secure deletion – Data is permanently deleted within defined timelines (e.g., 60 days) after a customer request.

If you have any further questions related to AiSentr security protocols please contact us at info@aisentr.com