Compliance you can show, not just claim
This page lists what Agentu does for each regime a business customer is likely to be under, which documents we sign, and — just as plainly — what is not yet in place. A compliance officer should be able to read it once and know where we stand.
GDPR (EU/EEA)
- Agentu acts as your processor under an Article 28 data-processing agreement; you remain controller.
- Data stored in Switzerland (AWS Zurich). Switzerland holds an EU adequacy decision, so hosting there is a permitted transfer with no extra mechanism. No transfer out of Switzerland for storage, backups or keys.
- Any access from a third country — a connected model, support — is covered by standard contractual clauses and a transfer-impact assessment, not by the Data Privacy Framework alone.
- Rights: access, export, rectification and erasure are self-service through keys; erasure is by crypto-shredding, effective in every backup.
- Breach notification to you without undue delay, so you can meet your 72-hour obligation.
- Records of processing, sub-processor list (Amazon Web Services) and a security annex matching the security page.
UK GDPR and the Data (Use and Access) Act
- Same processor terms, under the UK addendum or the IDTA where a transfer arises.
- Switzerland and the EEA are on the UK adequacy list, so hosting in either region is a permitted transfer.
- Transfer-risk assessments are kept for every model provider you connect from a UK memory.
Swiss FADP
- The revised Federal Act on Data Protection governs the service: every memory is stored in Switzerland under the FDPIC's supervision; the EEA and UK are Annex 1 destinations.
- Swiss standard clauses recognised by the FDPIC where data reaches a model outside Annex 1 countries.
United States
- There is no single US privacy statute; Agentu treats the strictest state law as the baseline (CCPA/CPRA, Virginia, Colorado, Texas and the others): service-provider terms, no sale or sharing, no use for training, honoured deletion.
- US customers are stored in Switzerland by default: encrypted content Agentu cannot read, under Swiss law. A regional home in the United States, in build, is for data that sector rules keep in the US — ITAR/EAR technical data, criminal-justice information, federal tax information and, for patients, Florida and Texas health records.
- HIPAA: Agentu is designed to act as a business associate (encryption, access control, audit logs, breach notification). Business associate agreements will be offered on the Enterprise plan once the US region is live.
- The Department of Justice bulk sensitive data rule: Agentu does not give access to covered persons in countries of concern, and operates no infrastructure in them.
Everywhere else
- Singapore PDPA, Japan APPI, Korea PIPA, Australia APP 8, Malaysia, Hong Kong, the Philippines and Thailand: Switzerland plus the contractual safeguards each law asks for; a Singapore home, in build, for customers whose rules require in-country storage.
- Brazil: the ANPD's mandatory standard clauses. Turkey: the KVKK standard contract, filed. Saudi Arabia: SDAIA clauses with a risk assessment.
- Where a country requires in-country storage that no Agentu region satisfies, we say so and do not serve that data. Country table →
The model-terms schedule
Every business agreement carries a schedule listing, for each model provider you connect, whether your data may be used for training (never, under the business terms we use), how long the provider may keep prompts for abuse monitoring, and whether a zero-data-retention route is in place. We keep it current; the summary is on the security page.
Documents we sign and publish
| Document | What it is | Status |
|---|---|---|
| Data-processing agreement | Article 28 terms with the EU and UK clauses, Swiss clauses and sub-processor list. | Professional launch |
| Security annex | The security model as a contractual commitment, with change control. | Professional launch |
| Model-terms schedule | Per-provider training, retention and zero-retention position. | Professional launch |
| Business associate agreement (HIPAA) | For US healthcare customers on Enterprise. | With the US region |
| Sub-processor list and notice | Amazon Web Services in Switzerland (Zurich), or in the regional home a customer chooses; 30 days' notice of any change. | Published here |
| Security review | The service is audited privately. A security annex covering the architecture, the cryptography and key custody is available to customers under NDA on request, so the contractual commitments can be checked against how the service is built. Agentu does not release its source code. | Under NDA, on request |
Certifications, audits and insurance — the honest position
SOC 2 Type II
Not yet held and not claimed. The audit is planned for the Professional launch; the report will be available under NDA when issued.
ISO 27001
Not yet held and not claimed. Planned to follow SOC 2.
Insurance
Cyber-liability and professional-indemnity cover for business plans is being arranged. The certificate of insurance and the cover limits will be published on this page when in force; until then, no plan is sold as insured.
Penetration testing
Independent testing is planned before the Professional launch; summaries will be published here.
Infrastructure
Amazon Web Services, which holds SOC 1/2/3, ISO 27001/27017/27018, PCI DSS and, in the US, FedRAMP and HIPAA eligibility. Agentu uses only services inside the customer's region.
Reporting a concern
privacy@agentu.com for data-protection matters, security@agentu.com for vulnerabilities (see security.txt).