Security

EzyAgents is designed to handle sensitive business data. Our platform is GDPR compliant and a Data Processing Agreement (DPA) is available on request to any customer organization.

We commission penetration tests from independent specialized providers, and we fix identified vulnerabilities according to their severity.

A SOC 2 Type II attestation is in progress. Until it is issued, we do not present it as achieved: Enterprise customers can request the current status and our internal controls documentation.

All data is encrypted in transit with TLS 1.3 and at rest with AES-256. Integration secrets (API keys, OAuth tokens of your connectors) are protected by an AES-256-GCM application-level encryption envelope, separate from database encryption.

Each customer's data is strictly isolated per tenant. An agent never accesses another organization's data.

Hosting and storage are located in the European Union. Model inference is handled by the AI provider your organization chooses: Anthropic (Claude) by default, OpenAI, Mistral, xAI or AWS Bedrock EU. These providers are contractually committed not to reuse your data to train their models.

Anthropic, OpenAI and xAI are based in the United States, under the same commitments. To keep inference in the European Union, choose Mistral or AWS Bedrock EU (from the Pro plan), or deploy EzyAgents in your own infrastructure (Enterprise plan). Image generation (Google or OpenAI) is off by default and only turns on by decision of the workspace administrator.

Human oversight (HITL, Human-In-The-Loop) is at the core of the platform. You define, action by action, what an agent can do autonomously and what requires explicit approval: sending an email, updating the CRM, following up with a customer.

The Tool Guard module enforces guardrails on tools: per-agent access scope, per-domain restrictions and validation of sensitive actions before execution.

Every agent action is timestamped and recorded in an exportable audit log, for full traceability.

Your data belongs to you. We do not sell it, do not share it and never use it to train AI models.

Each customer's knowledge base (documents, procedures, FAQs) is partitioned and only used to answer within their organization.

Internal access is limited to the strict minimum, following the principle of least privilege, and logged.

Every code change is reviewed before deployment. Third-party dependencies are audited, and packages with known unpatched vulnerabilities are rejected.

Production access follows the principle of least privilege and is tracked. Secrets are never committed to the repository.

You can export your data at any time from your workspace. Upon an account deletion request, your data is erased from our production systems within the timeframes set by our retention policy.

Enterprise customers can deploy EzyAgents in their own VPC or datacenter, in which case data never leaves their perimeter.

We welcome responsible disclosure. Please report any potential vulnerability by email to contact@ezyagents.fr.

For any other security-related question, contact us at contact@ezyagents.fr. We commit to acknowledging receipt promptly and keeping you informed as we handle it.