Privacy Policy

1. Introduction & Commitment

Agentis ("we", "our", or "us") operates the Agentis telemetry, observability, and runtime policy enforcement platform. We are committed to protecting the privacy, security, and integrity of your corporate data and your end-users' information when utilizing our software development kits (SDKs), APIs, and cloud dashboards.

2. Strict Zero-Model-Training Guarantee

We firmly uphold a zero-retention model training policy across all tiers:

• Zero Training: We will never use your proprietary prompts, tool definitions, model completions, context windows, vector embeddings, or metadata to train, fine-tune, evaluate, or improve any public, third-party, or internal artificial intelligence models.
• Zero Data Mining: Your operational telemetry is exclusively parsed to generate your private performance graphs, policy violation flags, cost calculations, and compliance evidence records.
• Metadata-Only Mode: Customers may enable strict metadata-only mode, where prompt bodies and completions are scrubbed on your host pod before network transmission, delivering zero-payload observability.

3. Information We Collect

Depending on your configuration and platform usage, we collect:

• Account Credentials: Work email address, full name, organization name, authentication tokens, and billing information processed securely via Stripe.
• Agent Telemetry Data: Distributed trace identifiers, parent-child span IDs, execution durations, model identifiers (e.g., GPT-4o, Claude 3.5 Sonnet, AWS Bedrock Titan), token usage counters, cost metrics, and error codes.
• Runtime Policy Logs: Declarative policy evaluations, guardrail trigger events, hard-block execution interventions, and cryptographic span hash digests.

4. Client-Side PII Scrubbing & Privacy Safeguards

When utilizing the init(redact_pii=True) SDK configuration, sensitive identifiers—including names, email addresses, phone numbers, credit card numbers, IP addresses, and Social Security Numbers—are redacted client-side before any payload exits your VPC or application boundary.

5. Data Security & Encryption Standards

Agentis employs multi-layered architectural safeguards aligned with SOC-2 Type II and ISO 27001 principles:

• Encryption in Transit: All HTTP and gRPC / OpenTelemetry (OTLP) data transmissions are enforced over TLS 1.3 with forward secrecy.
• Encryption at Rest: All stored telemetry, database entries, and backup archives are encrypted using AES-256 with keys managed in AWS Key Management Service (AWS KMS) with automated annual key rotation.
• Isolated Tenancy: Logical database separation and row-level security (RLS) isolate customer datasets. Dedicated single-tenant VPC deployments are available for enterprise customers.

6. Your Rights (GDPR & CCPA / CPRA)

Subject to applicable European Union (GDPR) and California (CCPA / CPRA) regulations, you and your authorized users retain the following statutory rights:

• Right to Access & Portability: Request a complete machine-readable export of all telemetry, evaluation runs, and audit logs.
• Right to Erasure ("Right to be Forgotten"): Request immediate cryptographic erasure of all stored traces, account data, and logs across active nodes and cold backups.
• Right to Rectification: Update inaccurate organization profile or account information at any time.
• Zero Sale or Sharing of Personal Data: We do not sell, rent, or share personal data with third-party data brokers or advertising networks.
• Non-Discrimination: Exercising your privacy rights will not result in any penalty or denial of service features.

7. Data Retention & Deletion Policy

Telemetry retention is defined by your subscription tier (ranging from 30 days on Observe to 1+ years on Enterprise). Upon customer cancellation or explicit account termination, all active operational records and encrypted archives are irreversibly purged within 30 days.

8. Sub-processors & Cloud Infrastructure

We host our core cloud services on tier-1 cloud providers including Amazon Web Services (AWS) and Google Cloud Platform (GCP) located in secure, SOC-2 certified facilities. We execute Data Processing Agreements (DPAs) with all underlying cloud hosting, payment (Stripe), and monitoring infrastructure partners.

9. Contact Us & Data Protection Officer

For privacy inquiries, GDPR/CCPA data subject requests, or to execute our standard Data Processing Addendum (DPA), please contact our security team: