Trust center

Security, privacy, and human control—without borrowed badges.

This page describes the security controls in the service today, the data flow they protect, where that data lives, and how long it stays. Last reviewed October 18, 2026.

Current controls

Authentication and sessions

Local passwords are salted and hashed with scrypt. Session cookies are HttpOnly, SameSite=Lax, Secure in production, and backed by HMAC-derived server-side session identifiers. Password changes can revoke every active session.

Secrets and customer credentials

Provider keys and connector or webhook secrets you enter are encrypted with AES-256-GCM under a key held on our servers, with a fresh random IV and authentication tag for each value. They are stored only in encrypted form, and only their last four characters are ever shown.

Tenant, team, and API boundaries

Each agent belongs to a company workspace. Owner, admin, sales, analyst, and viewer roles decide who can change agents, the sales pipeline, proof reports, retention settings, and team members. An invitation works only for the exact email it was sent to, and only once. Public API keys carry only the permissions they need, and every request is checked against the paid plan, rate-limited, traceable by request ID, and safe to retry without being processed twice.

Signed outbound integrations

Developer webhooks are signed with HMAC-SHA256 over the exact timestamp and body, delivered through a durable retry queue, and blocked from private or internal network destinations to reduce SSRF risk.

Abuse and spend controls

Public routes use capped JSON bodies and per-route rate limits. Agent traffic also supports owner-funded spend ceilings. Obvious bots are excluded from visitor analytics.

Deletion and retention

Owners can export request data and erase contact PII on demand. Erasure clears identity, message, and follow-up content while preserving non-identifying aggregate facts. A per-agent retention window can enqueue the same erasure path automatically every night.

Data flow

01
A site owner supplies business content, settings, and optional provider credentials.
02
A customer opens the website widget, the agent's Agent link page, or a connected messaging channel and sends text, voice, request, booking-request, or handoff data.
03
Only the data needed for the configured feature is sent to the selected AI, speech, messaging, email, billing, or infrastructure provider.
04
Make Agent Fast stores the site, conversation, request, attribution, optional opportunity, sync, and audit records needed to operate the selected workflow.
05
The owner can review activity, export requests, erase PII, or connect signed webhooks to another company system.

Where the data lives

Primary production data is hosted in Google Cloud's Seoul region. Cloudflare processes requests at its global edge, and enabled providers receive only the data their feature needs.

The primary application runs on Google Cloud Run and the primary PostgreSQL database runs on Cloud SQL, both in asia-northeast3 (Seoul). Private knowledge uploads use regional Cloud Storage.

No secondary database serves production traffic. Copies kept from before the September 2026 move to Google Cloud are held only as backups and are deleted when they are no longer needed.

Cloud SQL is configured for automated backups with 14 retained backups and seven days of point-in-time recovery logs. If the database is deleted, the deployment configuration requests a final backup retained for 30 days. Cloud SQL encrypts the database and these backups at rest with Google-managed keys.

Sub-processors receive only the data their purpose needs, in the regions listed below. The one full copy outside Google Cloud is an older backup from before the September 2026 move: a database copy in Neon and backup files in Cloudflare R2. Neither serves the live service.

How long we keep data

These windows are enforced automatically by scheduled jobs, not just written in a policy. Where no fixed period applies, the record stays until the owner deletes it — we would rather say so than round it up to a number.

Contact and request details an agent captured: Owner-set: until the owner deletes it by default, or 30, 90, 180, or 365 days. At the deadline the request's name, email, and message are erased and only non-identifying counts remain. The owner's notification about the request and the record of the visitor's confirmation email are separate copies that this window does not erase.
Messaging-channel message logs: Raw message logs: 30 days, then hard-deleted every night — Telegram, WhatsApp, Messenger, Instagram, Discord, and KakaoTalk alike. The conversation itself is also saved in the agent's conversation history (next row), and a request the visitor leaves follows the request rule.
Widget conversations, knowledge sources, agent settings, account records: No fixed period — kept until the owner deletes them, unless the owner sets a retention window for the agent, which also deletes conversations older than it. Deleting an agent or a knowledge source removes its rows and embeddings straight away.
Sign-in sessions: 1 day, or 30 days when you choose to stay signed in. Expired sessions are deleted every night.
Email delivery records: No fixed period for records of emails sent to visitors (request confirmations and access links); records of emails to account holders are removed when the account is deleted. They also serve as the ledger that stops an email being sent twice.
A deleted company: 30 days, then the organization, its agents, and every child record are purged permanently. The tamper-evident audit trail is the one thing kept.
Database backups: Cloud SQL retains 14 automated backups and seven days of point-in-time recovery logs; a final backup is configured for 30 days if the database is deleted. Erased data can remain in those protected backups until the applicable window passes.
Visitor identifier cookie: 365 days in the visitor's own browser. It links one visitor's conversations together and carries no name or email.

Owners do not have to wait for a window: exporting and erasing request data, deleting an agent, and deleting a company are all one action in the dashboard.

Sub-processors

The companies that can process customer data on our behalf, and only for the purpose next to their name.

Sub-processor	Purpose	Region
OpenRouter	Routes an answer to the model the agent is set to use	United States; the model provider it routes to (OpenAI, Anthropic, Google, xAI, DeepSeek, Qwen, Moonshot and others) may process elsewhere
OpenAI	Answer generation and live voice calls	United States
Google	Cloud Run hosting, Cloud SQL, private file storage, secrets, Gemini features, Google sign-in, and Workspace email delivery	South Korea and United States, depending on service
ElevenLabs	Text-to-speech for agent voices	United States
Speko	Voice routing	United States
Deepgram	Speech-to-text on voice routes that use it	United States
Polar	Billing and merchant of record for plans and credits	United States
SaaS Pro	Our own product: anonymous product analytics, heatmaps and page speed, masked session replay after visitor consent, error tracking, and scheduled-job monitoring	South Korea (Google Cloud, Seoul)
Cloudflare	Global DNS, TLS, web application firewall, edge routing, and caching in front of Google Cloud Run, plus R2 storage of older backup files	Global network
Upstash	Rate-limit counters keyed by IP address, kept only for each short window	Japan (Google Cloud, Tokyo)
Mailjet	Backup email provider; email is normally delivered through Google Workspace	European Union
Neon	Holds an older backup copy of the database only; does not serve the live service	United States (AWS us-east-1)

This list changes with 30 days' notice: every addition or replacement is announced on the changelog at least 30 days before that sub-processor starts processing customer data, so there is time to object. Changelog

Providers outside this list

Messaging platforms an owner connects — Telegram, WhatsApp, Messenger, Instagram, Discord, KakaoTalk — carry the conversation under that platform's own terms. Most connect through the owner's own account; one-click Discord setup uses Make Agent Fast's Discord app. When an owner saves their own provider key, that provider processes the call under the owner's contract with it. Integrations an owner connects — Cal.com, Calendly, Google Calendar, Notion, Google Drive — likewise run under the owner's own account with that service. Custom domains are not offered.

Availability and incidents

Self-serve plans carry no contractual service-level agreement, and we will not print one we do not owe you. These are the operational commitments we actually run.

Production releases are built from an exact Git commit by Cloud Build. Cloud Run will not serve a revision that fails startup, and the public health endpoint reports the deployed release SHA.
Cloud SQL automated backups and point-in-time recovery are configured. Recovery readiness is tracked separately; backup configuration alone is not treated as proof that a restore will succeed.
Incidents get a written note on the changelog once service is restored, including what broke and what changed because of it.

A contractual SLA, a named contact, and a security review can be negotiated as part of a pilot or enterprise agreement.

What the agent will not claim

An agent answers from the information its owner approved. When a question goes past that, it says so and brings in a person instead of guessing.

No invented answers. A question outside the approved information gets a plain "I don't have that" — not a guessed price, policy, or promise.
Handoff with context. When a visitor asks for a person, or a question is out of scope, the agent takes their details and notifies the owner, who sees the whole conversation in Conversations.
A person can step in. From Conversations the owner can pause the agent in a conversation and reply directly.

Need a signed data processing addendum?

Our controller–processor DPA is published in full, covers the sub-processors and retention windows on this page, and can be signed as it stands.

Read the DPA

Need a deployment-specific security review?

Email security@makeagent.fast or include the review in a pilot request.

security@makeagent.fast Get help launching your agent