Security and data ownership in Agency Root

• Your agency owns its business and employee data.
• You can export your data.
• You can submit a verified request to delete your account. Deletion requires re-authentication, so it cannot happen by accident.
• After a subscription is cancelled, data is kept for 30 days so you can export or recover it, and is then deleted from primary systems. Backups expire on their own retention schedule.

Each agency is a separate tenant. Data is isolated across the application, database, file storage and search.

The Agency Root team has no routine access to the content of your account. When you ask support to look at your data, access needs your approval, has a defined scope, expires automatically and is recorded in an audit history that cannot be edited.

• All traffic between the apps, the web administration and the servers is encrypted in transit with TLS.
• Databases and file storage are encrypted at rest.
• Passwords are stored with one-way hashing. Nobody, including an admin, can read a user's password.
• Shared document links are signed, expire and can be revoked.

• Two-factor authentication is mandatory for the owner or CEO and for super admins, and optional for other employees.
• Users can see their active sessions and devices, and log out a device remotely.
• Face ID or Touch ID only unlocks the app on the user's own device. Agency Root does not store biometric templates.

Every protected action is checked on the server against the user's role and scope. Roles and permissions are not an interface setting: hiding a field is not treated as security.

Sensitive reads and changes are recorded: role changes, exports, support access, financial edits and access to sensitive documents. Sensitive fields such as salary and ID numbers are excluded from general search results.

Client users are separate from employees and cannot inherit employee permissions. A client sees only client-safe information for their own company. Internal notes, salaries, costs, margins and other clients' data are filtered out on the server before anything reaches the client's app.

Encrypted backups are taken daily and kept for 30 days, with tested restoration procedures.

• AI and speech providers are used only under terms that prohibit training on customer data.
• Each AI request sends the minimum context needed.
• The AI retrieves only what the requesting user is permitted to see.
• An agency can turn AI off for the whole company.
• AI requests are recorded in the audit history.

How approvals and autonomy levels work is explained on the AI page.

If you believe you have found a security issue, report a security issue through the contact page and choose "Security report". Please do not access or change other users' data while testing.