Security & Privacy
Agently is built with security at every layer: passwordless authentication, workspace-level data isolation, OAuth for every integration, vaulted credential storage, cryptographically verified webhooks, and a granular permission system. Your workspace data is never used to train AI models. This page explains how your information is protected and what controls you have.
Authentication
Agently uses passwordless authentication, there are no passwords stored in Agently, ever.
- Email one-time code, enter your email, get a code, and you're in. Nothing to remember, nothing to steal.
- Google sign-in, authenticate with your Google account via the standard OAuth flow.
Sessions use signed tokens (JWTs) that are validated on every request and can be revoked at any time by signing out.
How Your Data Is Protected
Your data is yours. Everything in your workspace (conversations, documents, knowledge, tasks) belongs to that workspace. Workspaces are fully isolated: one can never read another's data. Deleting your workspace removes your data.
Encryption. All traffic travels over HTTPS (TLS in transit), and database connections are secured with TLS. Integration credentials are held in a secure credential vault, Agently's database never stores raw OAuth tokens, only connection references.
Infrastructure. Agently runs on secure cloud infrastructure with a managed Postgres database and regular security patching.
How Integrations Are Secured
Agently connects to 67 third-party services through a secure connection layer:
- OAuth only, you authorize access on the provider's own screen; Agently never sees your passwords.
- Vaulted credentials, tokens are held in a secure credential vault, not in Agently's database.
- Verified data, incoming webhooks and synced data are cryptographically verified to prevent tampering.
- Minimal permissions, only the access the agent needs is requested.
- Revocable, disconnect any integration anytime, from Agently or the provider's side.
- Workspace-scoped, connections are made per workspace, never globally.
What Jarvis Can and Can't Do
Jarvis can:
- Read from and write to your connected integrations within the scope you authorized.
- Search and retrieve knowledge from your Brain.
- Create and manage tasks, pages, and other workspace items.
- Search the public web.
Jarvis cannot:
- Access data outside your workspace.
- Act invisibly, every tool action is shown in the chat as it happens, and each app action is written to an audit log.
- Use integrations you haven't connected.
- Override workspace roles or permissions.
- Access another member's private data.
Human-in-the-loop for autonomous work
In everyday chat you're directing each step, so you see actions as they happen. For autonomous work (Missions that run on a schedule or in the background) you can require sensitive actions to be proposed for approval through the Decisions queue in your Inbox. Approve or reject before anything executes; anything not explicitly allowed waits for you. You always stay in control.
Access Control
Roles. Access is governed by three workspace roles, Owner (full control, including billing and deletion), Admin (manage settings, members, and integrations), and Member (use all features, no configuration). See Workspace Management.
Permissions. A resource-action permission model controls access across workspaces, pages, spaces, knowledge, and settings (with actions like create, read, update, delete, and manage) enforced at the API layer on every request.
Service-to-service. Internal communication between Agently's services is authenticated with API keys, so the agent service reaches backend data only through authorized channels.
Rate Limiting & Monitoring
- Rate limiting, requests are limited per user to prevent abuse, with stricter limits on sensitive endpoints like authentication and on real-time (live update) connections.
- Monitoring, error tracking and request logging use correlation IDs for debugging without exposing sensitive data.
- Hardened responses, standard security headers protect against common web vulnerabilities.
Security Controls You Have
| Action | How |
|---|---|
| Revoke an integration | Brain → Integrations → Disconnect |
| Remove a team member | Settings → Members → Remove |
| Delete a conversation | Delete it from the conversation list |
| Delete workspace data | Settings → Delete Workspace |
| Sign out of all sessions | Sign out of your account |
| Review agent actions | Check your Inbox for Decisions and activity |
Security Questions?
If you have concerns or questions about how your data is handled, reach us through the in-app support widget or our support channels.
Related Pages
- Integrations, How connections are secured
- Workspace Management, Roles and access control
- Inbox & Approvals, The Decisions approval system
- FAQ, Common questions and troubleshooting