Security & Compliance

Your data, our posture

AgentAegis processes the inputs you submit for analysis. This page states, plainly, what we handle and what we do not claim.

What we handle

agent system prompts, tool lists, and risk-appetite selections for guardrail recommendations.

Data handling commitments

Submissions run the product pipeline and are retained only as long as needed for your audit log (paid tiers) or until you delete the run.
We apply access controls consistent with GDPR Art. 32 (security of processing) where personal data is processed.
BYOK keys (Enterprise), when offered, are stored server-side only and never exposed to the browser.

Honesty rule: AgentAegis suggests filters and ratings; it does not guarantee blocked exfiltration, 100% safe tool use, or that you will never miss a dangerous action. We do not claim guarantee / 100% / never miss.

Our compliance posture

AgentAegis is decision-support, not a law firm, clinic, or certified auditor.
For binding advice, consult a qualified professional in the relevant domain.

Subprocessors & payments

Payments are processed by Waffo Pancake (merchant of record).
See Privacy and Terms for full terms.

refs: OWASP Top 10 for AI Agents · EU AI Act (Reg. 2024/1689) · OWASP LLM01