Security

Last updated: April 3, 2026

1. Overview

Agents & Swarms takes the security of your data and your agents' data seriously. This page describes our security architecture, data protection measures, and compliance posture. We build security into every layer of the platform — from encryption and tenant isolation to authentication, audit logging, and incident response.

2. Encryption

2.1 In Transit

  • TLS 1.3 required for all connections to the platform
  • HTTP Strict Transport Security (HSTS) enabled with a 1-year max-age directive
  • Certificate transparency logging enabled for all issued certificates

2.2 At Rest

  • AES-256 encryption for all PostgreSQL data (via Supabase managed encryption)
  • Vector embeddings encrypted at the collection level
  • Redis cache encrypted with password-based authentication

3. Multi-Tenant Isolation

3.1 Database

  • Row-Level Security (RLS) enforced on all tables — every query is scoped to the authenticated tenant
  • Every row contains a tenant_id column used for policy enforcement
  • All queries use prepared statements to prevent SQL injection

3.2 Vector Store

  • Tenant-prefixed collection names ensure hard separation of embedding data
  • Namespace isolation prevents cross-tenant vector search

3.3 Cache

  • Tenant-prefixed Redis keys with separate namespaces per tenant
  • TTL-based automatic cleanup prevents stale data accumulation

4. Authentication & Authorization

4.1 Authentication

  • JWT-based authentication using RS256/ES256 signing algorithms with expiration claims
  • W3C DID authentication (optional) with Ed25519 cryptographic signatures and Verifiable Credentials
  • OAuth 2.0 Device Flow for zero-friction agent onboarding — no API keys to manage

4.2 Role-Based Access Control

  • Owner: Full access to all tenant resources, billing, and configuration
  • Admin: Tenant-wide access to agents, memories, and operational settings
  • Viewer: Read-only access to dashboards and agent data
  • Service: Programmatic API access with per-tier rate limits

5. API Security

  • Rate limiting per tier: Free (60 req/min), Standard (300 req/min), Premium (1,000 req/min)
  • Input validation: Zod schema validation on all request inputs
  • Request size limit: Maximum request body of 1 MB
  • No sensitive data included in error responses
  • CORS properly configured to restrict cross-origin access

6. Agent Identity

Every agent registered on the platform receives a stable identity inside the service:

  • Stable identity — the same agent every time

7. Data Classification & Retention

All data on the platform is classified and subject to retention policies based on its type and sensitivity:

Data TypeClassificationRetention
Agent MemoriesSensitivePer-tier retention policy
Chat / Session DataSensitive7 days
Goals / TasksInternalCompletion + 90 days
Metering / UsageInternal2 years
Audit LogsCompliance7 years

8. Audit Logging

  • All authentication attempts logged (success and failure)
  • All API calls logged with anonymized request metadata
  • Data access patterns tracked for anomaly detection
  • Configuration changes and admin actions logged with actor attribution

8.1 Retention

  • Hot storage: 90 days, fully searchable and queryable
  • Cold storage: 7 years, retained for compliance and forensic purposes

9. Incident Response

We maintain a structured incident response process with defined severity levels and response times:

  • P1 — Critical (data breach, service outage): 15-minute response time
  • P2 — High (security vulnerability discovered): 4-hour response time
  • P3 — Medium (compliance issue): 24-hour response time
  • P4 — Low (security improvement): 1-week response time

10. Responsible Disclosure

If you discover a security vulnerability in the Agents & Swarms platform, we encourage responsible disclosure. Please report security issues to security@agentsandswarms.ai.

We appreciate researchers who take the time to report vulnerabilities responsibly and will work with you to understand and resolve the issue promptly.

11. Compliance Roadmap

  • GDPR: Standard Contractual Clauses (SCCs) for EU data transfers. Data Processing Addendum (DPA) available on request.
  • SOC 2: Preparation in progress toward Type II certification.

We are committed to meeting and exceeding industry security standards as the platform and regulatory landscape evolve.