Trust center
Security & privacy
AgentReady analyzes public websites while keeping account data and generated files private to their owner. This page explains our current controls, what enters the service, and how long we keep it.
Last updated 18 September 2026
SOC 2 readiness
AgentReady is not currently SOC 2 certified, and no independent SOC 2 audit report is available. We are building toward audit readiness using the Trust Services Criteria as a guide rather than presenting readiness work as certification.
- Access is limited by account ownership, least privilege and server-verified operator roles.
- Traffic is encrypted in transit over HTTPS, and managed infrastructure provides database protection and recovery controls.
- Analysis jobs, account activity, billing changes and operational failures create records for review.
- Public scanning is constrained to public web addresses, with protections against access to private networks.
- Payment events are signature-verified before subscription records are changed.
- Security reports and suspected incidents can be sent directly to our support contact.
How analysis uses your data
The scanner requests your submitted site and a limited set of public pages and machine-readable files. Public page content and the business description you provide may be sent to an AI model to draft your files. We instruct generation to use observed evidence and not invent business facts. AgentReady does not log in to, modify or deploy files to your website.
Data retention
Account details, saved sites, generated files and related product records are retained while your account is active so history, downloads and monitoring continue to work.
After account deletion, we delete this customer content promptly, except records that must be retained for legal, tax, fraud-prevention or accounting obligations. Technical logs are deleted or anonymized within 12 months. Payment records held by Paddle follow Paddle’s legal retention requirements.
Questions or security reports
To report a suspected vulnerability, ask about data handling, or request access, correction or deletion, contact us. Please do not include sensitive credentials in your message.