Saygents agents handle real conversations with real customers — names, phone numbers, project details, payment intent. The controls below are how we keep that data inside your tenant, off shared training sets, and out of reach of anyone who does not have a documented reason to read it.
Each pillar describes one specific control, what it protects, and how it is enforced. If your procurement team needs a deeper dive, email security@saygents.com.
Every byte that moves between a customer, your agent, and our database is encrypted in transit with TLS 1.2 or higher. Every byte at rest sits inside AES-256-encrypted volumes managed by our cloud provider.
Every Saygents customer is a separate tenant. Your agents, your conversations, your customers, and your knowledge base live in your tenant. There is no path — by URL, by API token, or by user account — for one tenant to read another tenant's data.
Your customers' conversations, your knowledge base, your pricing — none of it is used to train shared models. Saygents is built on Anthropic's Claude Sonnet 4.6, used as a hosted inference service. Conversation data is never sent to a training set, ours or theirs.
Saygents employees can only access tenant data when there is a documented support reason. Access is gated by single sign-on, requires a second factor, and every read of tenant data is logged.
Saygents uses a small set of well-known sub-processors to deliver the service. We list each one, what it does, and where it stores data.
Saygents stores customer data in US regions on Vercel and Supabase. If your jurisdiction requires data to remain in a specific region, email security@saygents.com before signing — we will tell you honestly whether we can meet that requirement today.
We keep conversation data only as long as you need it. The default retention is 24 months for active tenants. You can shorten or extend retention per agent, and you can delete a conversation at any time from the dashboard.
Customer messages routinely contain personal data — names, emails, phone numbers, addresses. We treat that as standard PII and protect it with the controls above. We do not, however, accept regulated categories like PHI, payment card data, or government identifiers without a written agreement.
If something goes wrong — a vulnerability disclosure, an internal access anomaly, an outage that affects your customers — we have a documented response runbook. Material security incidents are reported to affected tenants within 72 hours.
We tell you the actual status — including what is in progress and what we don't cover by default. No vague "enterprise-grade" claims.
Saygents acts as a data processor for tenant customers. DPA available on request. We honor data subject access, deletion, and portability requests routed through the tenant.
California consumer rights are honored through the same data subject request flow as GDPR. We do not sell personal information.
PHI is not in scope by default. Healthcare-adjacent customers can request a BAA after a fit review with our team.
Saygents secures the platform — infrastructure, encryption, tenant isolation, model access. You are responsible for what your agent is configured to do, what data your customers send into it, and who in your team can log into the dashboard.
In United States regions on Vercel (compute and edge) and Supabase (primary database). If your jurisdiction requires data to remain in a specific region, email security@saygents.com before signing.
No. Saygents uses the Anthropic Claude API in zero-data-retention mode for inference. Conversation content is never sent to a training set — ours or any third party. Your knowledge base stays inside your tenant boundary.
24 months by default. Each agent can be configured for shorter retention (30 / 90 / 365 days). Individual conversations and customer records can be deleted at any time from the dashboard.
On cancellation, your tenant enters a 30-day deletion window. Within that window, we can restore the tenant on request. After 30 days, all conversation data, customer records, and agent configurations are permanently deleted from primary storage. Encrypted backups age out within 90 days.
Yes. Our DPA is available on request and reflects our role as a processor for tenant customers' data. We will sign it before subscription start for any customer who requests one.
PHI and PCI data are not in scope by default. We do not accept agents configured to elicit those categories without a signed addendum and a fit review with our team. The standard security baseline covers all other customer PII.
Email security@saygents.com with the details. We acknowledge within one business day and provide a remediation timeline within five. Critical vulnerabilities affecting customer data are triaged immediately.
Vendor questionnaire, security review call, DPA redlines, BAA fit review — email us and a real human responds within one business day.