This page explains how Aijency protects the personal data processed by Aijent on your website. It is intended for enterprise clients, procurement teams, and security reviewers.
| Question | Answer |
|---|---|
| Is visitor data encrypted in transit? | Yes — TLS (HTTPS) |
| Is visitor data encrypted at rest? | Yes — AES-256 |
| Is a Data Processing Agreement in place with Anthropic? | Yes — included in Commercial Terms |
| Is data stored in Australia? | Yes — Supabase ap-southeast-2 (Sydney) |
| Is platform activity logged and monitored? | Yes — immutable audit log + error & uptime monitoring |
| Does Anthropic train models on your data? | No — Per Data Processing Agreement with Aijency |
| Is data sold to third parties? | No |
| Is data used for advertising? | No |
Aijent securely collects only the information a visitor voluntarily provides during a conversation. This encrypted data typically includes:
No browsing history, device fingerprinting, or passive tracking data is collected. A single anonymous visitor identifier (aijency_vid) is stored in browser local storage for session continuity only — it is a randomly generated UUID and is not used for cross-site tracking.
Visitor submits a message in the chat widget Transmitted over HTTPS (TLS) to Aijency’s application servers. Function compute is pinned to Vercel’s Sydney region (ap-southeast-2); the message is processed there transiently — no lead data is stored at this layer.
Aijency calls the Anthropic Claude API The conversation is processed transiently by Anthropic to generate Aijent’s response. Anthropic does not retain this data after the request completes and does not use it to train models. This is a contractual obligation under Anthropic’s Commercial Terms and DPA.
Lead data is stored in Aijency’s database Stored in Supabase PostgreSQL, ap-southeast-2 (Sydney, Australia). Encrypted at rest. Row-level security enforced per client tenant — no tenant can access another tenant’s data.
Data is synced to your connected CRM Sent via OAuth 2.0 to your connected CRM (e.g. HubSpot). OAuth tokens are encrypted at rest using AES-256-GCM. Only your authorised CRM account receives this data.
Aijent is powered by the Anthropic Claude API. The following protections apply:
Anthropic’s full DPA is publicly available at anthropic.com/legal/data-processing-addendum. Compliance documentation including SOC 2 Type II, ISO 27001:2022, and ISO/IEC 42001:2023 certifications is available at trust.anthropic.com.
| Certification | Scope | Where to verify |
|---|---|---|
| SOC 2 Type II | Security, availability, confidentiality controls | trust.anthropic.com (available under NDA) |
| ISO 27001:2022 | Information security management | trust.anthropic.com |
| ISO/IEC 42001:2023 | AI management systems | trust.anthropic.com |
The following sub-processors handle personal data on behalf of Aijency clients:
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic | AI processing (Aijent conversational responses) | United States |
| Supabase | Database and file storage (data at rest) | Australia (ap-southeast-2, Sydney) |
| Vercel | Application hosting and edge delivery (transient compute; no customer data stored at rest) | Australia (ap-southeast-2, Sydney) — function compute; global edge for static delivery |
| Stripe | Subscription billing and payment processing | United States |
| Resend | Transactional email notifications | United States |
| Sentry | Application error monitoring and alerting (diagnostic data) | United States |
| PostHog | Product analytics — authenticated client dashboard only (not website visitors) | United States |
Aijency reviews all sub-processors before engagement and maintains data processing agreements with each.
For any security related questions, please contact info@aijency.ai.