Create AI employee

Security and Incident Response

Draft for legal review. Version 2026-10-22.

Measures

  • Encryption in transit: HTTPS everywhere. At rest: the database and file storage are encrypted by the hosting provider [confirm: Supabase AES-256].
  • Tenant isolation: every customer table carries the organization and is protected by row-level security in the database; server routes check membership before every read or write; tests prove one customer cannot read another's data.
  • Least privilege: the database's full-access key is used only on the server, never in the browser. Platform administrators are listed in the database, not granted by account settings.
  • Abuse protection: rate limits per visitor, IP and agent; plan and cost limits reserved before every AI call; bot protection on the free preview.
  • Safe website reading: only public http(s) pages; private, local and cloud-metadata addresses are refused, also after redirects; robots.txt is respected.
  • AI safety: website content and customer knowledge are treated as data, never as instructions; customer agents cannot call tools; the Agentik Assistant can only prepare settings changes that the user confirms.
  • Audit: administrative actions are logged with actor, time and IP.
  • Support access: when support needs to see a customer's account, an administrator opens it read only for at most 30 minutes; nothing can be changed or exported, and every access is logged with who opened it and when.
  • Secrets: kept in the hosting provider's secret store, never in code.
  • Backups: daily database backups by the hosting provider [confirm plan and point-in-time recovery for production].

Incident response

  1. Detect: alerts from the hosting providers, error monitoring [to be set up], reports to [security@agentik.example].
  2. Contain: revoke keys, pause affected features (kill switch), block abusive sources.
  3. Assess: what data, which customers, how many people, the likely risk.
  4. Notify: customers (as controllers) without undue delay and where feasible within [48] hours; where Agentik is the controller, the supervisory authority within 72 hours of becoming aware, unless the breach is unlikely to result in a risk; affected people when the risk is high.
  5. Recover and learn: fix the cause, restore from backups if needed, write a post-mortem and record the breach in the breach register.