Security & Compliance

Certifications

How we protect client data

• Where the engagement allows, we work inside the client environment, so client data remains in the client cloud tenancy under the client's controls and retention rules.
• Access is least privilege and time bound. Engineers receive only the systems their role requires, and access is removed on the day an engineer rolls off.
• Data is encrypted in transit and at rest using the platform-native controls of the cloud the work runs on.
• Credentials and API keys are held in a managed secrets store. Secrets are not stored in code, tickets, or chat.
• Production, staging, and development environments are separated. Client data is not copied into non-production environments without written approval.

How we build

• Every change is peer reviewed and version controlled before it reaches production.
• Dependencies and container images are scanned for known vulnerabilities, and findings are triaged on a fixed cadence.
• Infrastructure is defined as code, so what runs in production matches what was reviewed.
• Changes ship with a rollback path.

Controls for agentic systems

Autonomous systems require controls beyond traditional application security. The following apply to every agent we put into production:

• Each agent holds only the system access its task requires, issued under a service identity that can be revoked independently of any human account.
• Routine, unambiguous work is automated, and judgment remains with the client team. Approval steps are placed at actions that carry risk.
• Agents are tested against a defined evaluation set, and behavior is measured against it on every change.
• Every agent action is logged with its inputs, outputs, and the identity it ran under, so decisions can be traced.
• Client data is not used to train third-party foundation models. Model providers are configured to exclude prompts and outputs from provider training.
• Agents run inside the client security boundary, reach only approved systems, and can be stopped without taking the surrounding application down.

Our people

• Engineers are employed under written confidentiality obligations that survive their employment.
• Background verification is completed before an engineer joins a client engagement.
• Security awareness training is completed at onboarding and refreshed annually.
• Access, devices, and accounts are revoked on the last working day as part of offboarding.

Where we operate

Agivant is headquartered in San Jose, California, and operates engineering centers in Pune and Hyderabad, India. Before an engagement begins, we confirm the locations from which client data may be accessed, and we work to the client's data residency and regulatory requirements.

Security incidents and vulnerability reporting

We investigate every suspected security incident, contain it, and notify affected clients with what we know, what we have done, and what we need from them. Incident obligations, including notification timelines, are set in the agreement for each engagement.

Vulnerabilities or security concerns relating to our website or our engineering work can be reported to infosec@agivant.com. We acknowledge every report. We will not pursue legal action against security researchers who report findings in good faith and who avoid privacy violations, service disruption, and data destruction.

Documentation available under NDA

The following can be shared under NDA, usually within two business days:

• Current SOC 2 Type II report
• Most recent penetration test summary
• Completed security questionnaire, including CAIQ and SIG formats
• Subprocessor list for the engagement
• Standard data processing addendum