Skip to content

Platform Security

This page covers the Agend Product Suite (Next.js / Vercel / Supabase)-specific implementation of our security controls. For company-wide security principles, see Trust & Compliance — Security Framework. For authentication and password-specific detail, see Authentication & Password Security.

Data Protection

  • Encryption at rest: handled at the infrastructure level (Supabase/AWS), with additional application-layer encryption (AES-256-GCM) for particularly sensitive credentials such as payment gateway secrets.
  • Encryption in transit: TLS everywhere; all webhook endpoints must be HTTPS.
  • Secrets management: sensitive keys (e.g. for enterprise SSO) are held in Supabase Vault rather than in application code or config.
  • Tenant isolation: every account-scoped table enforces row-level security (RLS) so one customer's data cannot be accessed by another — this is tested with automated cross-tenant-leak regression tests as part of our release process.

API & Integration Security

  • Scoped API keys: API keys are scoped and stored as HMAC hashes, with rate limiting at the gateway.
  • SSRF protection: outbound requests validate resolved IP addresses and block loopback, private-network, and cloud-metadata endpoints.
  • Signed webhooks: outbound webhooks are signed (HMAC-SHA256), timestamped, and replay-protected.
  • Application hardening: CSRF protection, secure headers and Content Security Policy, server-side input validation, and CAPTCHA (Cloudflare Turnstile) on public-facing forms.

Payments (PCI)

Agend Product Suite never stores cardholder data (card numbers or CVC). Card entry happens via hosted gateway pages and tokenisation through Stripe and eWay — both PCI DSS Level 1 providers. This is a PCI DSS SAQ-A posture, consistent with our position across Agend products — see PCI Compliance.

Monitoring & Audit

  • Audit logging: an immutable, account-scoped audit log records security-relevant activity.
  • Error & anomaly monitoring: Sentry monitors for errors and anomalies in production, with sensitive request data redacted before it's captured.
  • Structured logging: application logs are structured for consistent searchability and alerting.

Secure Development Process

Every change to Agend Product Suite passes through code review and automated test/lint/type-checking gates before it is deployed — see Deployment & Release Process for our release cadence.

Certification Status

Aligned with, not certified to

Agend is not currently certified to ISO 27001, ISO 9001, or SOC 2. Where we describe our posture as "aligned with" a standard, this reflects the controls we have in place today, not a formal certification. See Compliance & Standards for a detailed, honest breakdown of what's in place and what's still in progress.

Agend Product Suite is built on infrastructure providers who do hold independent certifications in their own right (Supabase, Vercel, Stripe, eWay, Xero) — see Data Hosting & Sovereignty for the current list and their certifications.

Service Commitments

  • Availability: 99.9% monthly target, with service credits available under our service level agreement if not met.
  • Backups: daily backups, 30-day retention, 24-hour recovery point objective (RPO), 8 business hour recovery time objective (RTO).
  • Breach notification: within 48 hours of confirming a data breach.
  • No AI training on customer data: we do not use customer data to train AI models, under any circumstances.

Questions about platform security can be directed to security@agend.com.au.