Security at AgentGuardian
Last updated: 22 June 2026
AgentGuardian governs AI agents, so it is built to be governed itself. The architecture keeps your sensitive data in your own cloud account, isolates every tenant, encrypts data in transit and at rest, and gives even our own operators no standing access to customer data.
Data residency & the metadata boundary
The AgentGuardian collector runs inside your cloud account. It parses your logs and billing locally and pushes only the metadata required for governance — agent IDs, models, token and cost figures, owners, and policy state. Your raw model invocation logs, prompts, responses, and full billing files never leave your account.
Tenant isolation
Every customer’s data is isolated at the database layer with row-level security: each record carries a tenant identifier and access is filtered by the authenticated tenant, with cross-tenant access denied by default and verified by automated tests.
Encryption
Data is encrypted in transit (TLS) and at rest. The collector authenticates to the control plane over mutual TLS, and stored telemetry is encrypted in the cloud provider’s managed storage.
Access control
Access within the product is role- and scope-based and deny-by-default: a user sees only the agents and data within their scope. Secrets such as API keys are reveal-once — only a hash and the last four characters are stored — and secret values are scrubbed from logs and telemetry before they leave the application.
Vendor access is time-boxed and audited
Glacien operators have no standing access to customer data. Support access is requested for a specific case, approved, time-limited, read-only where possible, clearly indicated on screen, and fully audited — the session ends on a click and is logged.
Operational security
- Centralised, correlated logging with secret redaction at every sink.
- Append-only audit trail for privileged and governance actions.
- Least-privilege cloud roles; read-only discovery is separated from any enforcement role, which stays disabled until you enable it.
- Infrastructure managed as code and deployed through a reviewed pipeline.
Responsible disclosure
We welcome reports from security researchers. If you believe you have found a vulnerability in AgentGuardian or the agentguardian.io website, please email security@agentguardian.io with enough detail to reproduce the issue. Please:
- give us a reasonable time to investigate and remediate before any public disclosure;
- avoid privacy violations, data destruction, and service degradation while testing;
- only test against your own account or with explicit authorisation.
Acting in good faith under this policy, we will not pursue legal action against you and will work with you on timing and credit.
Note: formal certifications and a published security.txt are tracked separately; this page describes the controls in place today.
Contact
Security: security@agentguardian.io · Privacy: Privacy Policy.