[ Security Compliance ]
Security is a build-time decision, not a post-launch audit. These are the controls we apply to our own systems and to every client engagement.
Last revised: August 2026
Every engineer authenticates with SSO and hardware-backed multi-factor authentication. Access to client environments is least-privilege, time-bound, and revoked automatically when an engagement ends.
Production credentials are never stored on laptops. Secrets live in managed vaults and are injected at runtime.
All traffic is TLS 1.2 or higher. Data at rest is encrypted with AES-256 using managed keys, with rotation policies defined per environment.
Where we handle regulated data, we scope it into isolated environments with separate keys and separate audit trails.
Every change is peer reviewed before merge. Pipelines run dependency scanning, static analysis, secret detection, and automated tests on each commit.
Infrastructure is defined as code and reviewed the same way as application code, so environments are reproducible and drift is visible.
Systems we operate ship structured logs, metrics, and traces to centralised observability with alerting on error rates, latency, and anomalous access.
We triage suspected incidents immediately, contain first, and notify affected clients within 24 hours of confirmation with a written root-cause analysis to follow.
Our controls are built around SOC 2 and ISO 27001 practices, and we support GDPR, HIPAA, and PCI-DSS requirements in engagements where they apply.
We complete client security questionnaires and sign mutual NDAs and data processing agreements as part of onboarding.
If you believe you have found a vulnerability in this site or in something we built, email hello@agenco.co with steps to reproduce. We acknowledge reports within two business days and will keep you updated until it is resolved.
Please do not run automated scans against client production systems or access data that is not yours.
Need something clarified?
Contact Us