AgencyPro security and data protection

Data protection

We implement multiple layers of security to protect your data:

• Encryption: Data is encrypted in transit over HTTPS, and stored files are encrypted at rest
• Secure storage: Files are stored with permission-based access, and file operations are logged
• Access controls: Access to production systems is limited to authorized personnel
• Data backup: Regular automated backups
• Data retention: Data retention and deletion follow our privacy policy, and you can export your records before you leave

Infrastructure security

AgencyPro runs on established cloud providers:

• Cloud security: Our cloud infrastructure providers (AWS, Vercel) hold SOC 2 Type II reports
• DDoS protection: Traffic filtering and DDoS mitigation at the hosting layer
• Monitoring: Automated monitoring and alerting on our infrastructure
• Vulnerability management: We run penetration tests on AgencyPro

Application security

Our application security measures include:

• Authentication: Password requirements, and multi-factor authentication (MFA) is available
• Authorization: Role-based permissions, so team members and clients see only what their role allows
• Session security: Session timeout settings
• Input validation: Input validation and sanitization
• Audit logging: File operations and key account actions are logged
• API security: API access uses tokens you create and revoke in workspace settings (Plus)

Compliance and certifications

Where we stand on common security and privacy standards:

• SOC 2 Type II infrastructure: We host on SOC 2 Type II certified providers (AWS, Vercel). AgencyPro's own SOC 2 audit is on our roadmap.
• GDPR: We follow GDPR requirements for personal data of people in the EU; see the privacy policy
• CCPA: We follow the California Consumer Privacy Act for California residents; see the privacy policy
• PCI DSS: Payments processed through Stripe, a PCI DSS Level 1 service provider

Note: SOC 2 Type II certification on this page refers to our cloud infrastructure providers. AgencyPro itself is in the process of pursuing its own SOC 2 audit.

Security policies

Our internal security policies cover:

• Information security: Who can access what, and how access is granted and removed
• Data handling: How customer data is handled based on sensitivity
• Incident response: Steps for containing and communicating a security incident
• Staff awareness: Security practices for everyone with system access
• Vendors: Reviewing the security of third-party services before we use them

Incident response

If a security incident happens, we will:

• Contain and assess the incident
• Notify affected customers within 24 hours
• Provide regular updates throughout the response process
• Review what happened after the incident
• Implement additional safeguards to prevent recurrence

Security practices for your team

We recommend the following security practices for all users:

• Enable multi-factor authentication (MFA) on your account
• Use strong, unique passwords for your AgencyPro account
• Regularly review user access and permissions
• Keep your devices and browsers updated
• Be cautious of phishing attempts and suspicious emails
• Log out of your account when using shared devices

Security testing

How we check our own work:

• Penetration testing
• Code review before releases
• Dependency updates for known vulnerabilities
• A third-party SOC 2 audit of AgencyPro itself is on our roadmap

Reporting security issues

If you discover a security vulnerability, please report it to us immediately: