How we handle the data your agent touches.

• EU-region hosting by default (Supabase, PostHog, InteractiveAI runtime).
• TLS 1.2+ in transit. Database-at-rest encryption via cloud-provider default.
• Row-level security on all catalog tables; least-privilege access control.
• Agent actions logged with timestamp, decision rationale, and version of the policy that produced the action.
• Retention windows configurable per engagement; default is 24 months for operational logs, deletion on request where contractually permitted.

• Website + catalog: Vercel edge (EU routing) + Supabase (EU-West-1).
• Analytics: PostHog (EU region, Frankfurt).
• Agent runtime: InteractiveAI, EU-region by default; US or in-region hosting available on contract.
• Email delivery: Resend (EU routing available).
• Error monitoring: Sentry (region selected per project).

• Scope boundaries: every capability has an explicit list of integrations, data sources, and allowed actions. Nothing happens outside the configured scope.
• Escalation rules: policy-sensitive cases, VIP senders, and out-of-scope requests route to a human owner with context attached.
• Evaluator tests: every capability ships with a regression test suite run on every policy update.
• Versioned changelog: prompt, policy, and tool changes are versioned. You can answer "what did the agent know when it did that?" months after the fact.
• Monthly business review: included with every operating retainer, covers incidents, drift, and roadmap.

• GDPR: processor-side DPA available on request.
• SOC 2. InteractiveAI runtime operates under SOC 2 Type II controls; Agents Makers' own SOC 2 readiness program is in progress for 2026.
• EU AI Act: each role is classified at the capability level (minimal / limited / high risk). Classification is part of the scoping artifact and is reviewed when the role's scope changes.
• ISO 27001: target certification window under evaluation.

If you believe you've found a security vulnerability, email ngarzotto@interactive.ai with a description and reproduction steps. We acknowledge all reports within two business days.