Data Security and Privacy
Last updated 3 August 2026 · Version 2.0
This page explains how Aijency protects the personal data processed by Aijent on your website. It is intended for enterprise clients, procurement teams and security reviewers.
At a glance
| Question | Answer |
|---|---|
| Is visitor data encrypted in transit? | Yes — TLS (HTTPS) |
| Is visitor data encrypted at rest? | Yes — AES-256 |
| Is a Data Processing Agreement in place with Anthropic? | Yes — included in Commercial Terms |
| Is data stored in Australia? | Yes — Supabase ap-southeast-2 (Sydney) |
| Is platform activity logged and monitored? | Yes — append-only audit log + error & uptime monitoring |
| Does Anthropic train models on your data? | No — per Data Processing Agreement with Aijency |
| Is data sold to third parties? | No |
| Is data used for advertising? | No |
1. What data Aijent collects
Aijent collects only the information a visitor voluntarily provides during a conversation. This typically includes:
- Full name
- Email address
- Company name
- Phone number
- Business needs discussed during the conversation
- The full conversation transcript
It also receives the visitor’s time zone from their browser, so meeting times are offered in local time, and the address of the site the widget is on, so the right Aijent answers.
No browsing history, device fingerprinting or passive tracking data is collected. No IP address, user agent or referrer is stored. The widget keeps three values in the visitor’s browser: a randomly generated visitor identifier for session continuity, a copy of it set by the embed script, and a timestamp of the last engagement so the same person is not prompted repeatedly. None is used for cross-site tracking.
2. How data flows
Visitor submits a message in the chat widgetTransmitted over HTTPS (TLS) to Aijency’s application servers. Function compute is pinned to Vercel’s Sydney region (ap-southeast-2); the message is processed there transiently, and no lead data is stored at this layer.
Aijency calls the Anthropic Claude APIThe conversation is processed by Anthropic to generate Aijent’s response, under Anthropic’s Commercial Terms and DPA, which prohibit its use for model training. Retention is governed by those published terms. Aijency also uses Anthropic’s prompt caching, which holds your Aijent’s instructions and knowledge base content for up to one hour so replies are faster.
Lead data is stored in Aijency's databaseStored in Supabase PostgreSQL, ap-southeast-2 (Sydney, Australia). Encrypted at rest. Row-level security enforced per client tenant, so no tenant can access another tenant’s data.
Data is synced to your connected CRMSent via OAuth 2.0 to your connected CRM. OAuth tokens are encrypted at rest using AES-256-GCM. Only your authorised CRM account receives this data.
3. AI processing — Anthropic
Aijent is powered by the Anthropic Claude API. The following protections apply:
- No model training. Anthropic confirmed in writing that API inputs and outputs are not used to train models by default. This is a contractual obligation, not a policy preference.
- Processed under contract. Conversation data is processed to generate a response under Anthropic’s Commercial Terms and DPA. Retention is governed by those published terms.
- Data Processing Agreement. A DPA, including Standard Contractual Clauses (SCCs) for GDPR compliance, is automatically incorporated into Anthropic’s Commercial Terms of Service. By accepting those terms, Aijency has a legally binding DPA with Anthropic as a sub-processor.
Anthropic’s full DPA is publicly available at anthropic.com/legal/data-processing-addendum. Compliance documentation including SOC 2 Type II, ISO 27001:2022 and ISO/IEC 42001:2023 certifications is available at trust.anthropic.com.
4. Anthropic certifications
| Certification | Scope | Where to verify |
|---|---|---|
| SOC 2 Type II | Security, availability, confidentiality controls | trust.anthropic.com |
| ISO 27001:2022 | Information security management | trust.anthropic.com |
| ISO/IEC 42001:2023 | AI management systems | trust.anthropic.com |
5. Sub-processors
The complete list of companies that process personal data on Aijency’s behalf, with what reaches each one, is published at sub-processors. Aijency reviews sub-processors before engagement.
6. Applicable privacy frameworks
- Australian Privacy Act 1988, the primary governing framework
- GDPR (EU/UK), with Standard Contractual Clauses in place through our providers
- PDPA (Singapore), supported via contractual DPA chain
7. Technical security controls
- All data in transit encrypted via TLS (HTTPS enforced on all connections)
- All OAuth tokens encrypted at rest using AES-256-GCM
- Application secrets and the data-encryption key are held in a dedicated, access-controlled secrets manager, kept out of source code and governed by a documented key-management policy
- Row-level security enforced at the database level, so tenant data is strictly isolated
- OAuth 2.0 with PKCE wherever the provider supports it
- Managed PostgreSQL with encryption at rest, hosted in ap-southeast-2 (Sydney)
- Static code analysis (SAST) and secret scanning on every change merged to the main branch, plus a scheduled weekly scan
- Append-only audit logging of security-relevant events. Records cannot be modified or deleted through the application, and are removed only when a customer’s account is deleted
- Continuous application error monitoring and alerting across all environments
- Uptime and availability monitoring with alerting and a public status page
8. Enterprise enquiries
For any security related questions, procurement questionnaires, DPAs or vulnerability reports, please contact info@aijency.ai.