We take the security of your customer data seriously. This page describes the controls in place today — and what we're actively working toward. We don't claim certifications we don't hold.
Working toward SOC 2 Type II. We are building our information-security program toward a SOC 2 Type II report. We are not yet certified and do not currently hold SOC 2 or ISO 27001. We will update this page as that changes.
Authentication & access
- Two-factor authentication: optional TOTP-based 2FA with backup codes, available to every user.
- Single sign-on (SSO): SAML 2.0 and OIDC for Enterprise organisations, with automatic provisioning into your workspace.
- Role-based access control: organisation roles (owner, admin, manager, member, viewer) enforced on every request, following least-privilege principles.
- Email verification: required for new accounts before access is granted.
Data protection
- Encryption in transit: all traffic is served over TLS 1.2 or higher.
- Encryption at rest: data is stored on managed infrastructure with encryption at rest; sensitive credentials such as OAuth tokens are additionally encrypted at the field level with AES-256-GCM.
- Your data rights: you can export or delete your data at any time, consistent with GDPR and CCPA.
- No training on your data: we do not use your customer data to train external AI models.
Monitoring & audit trail
- Tamper-evident audit log: security-relevant events — sign-in, access and role changes, resource sharing, and administrative actions — are recorded in a hash-chained, append-only audit trail.
- Error & uptime monitoring: application errors and system health are continuously monitored. Live operational status is published at ultragent.ai/status.
Vulnerability management
We monitor our software dependencies for known vulnerabilities and remediate on a regular cadence, prioritising high-severity issues.
Sub-processors
We rely on a small set of infrastructure and service providers to operate Ultragent. A current sub-processor list is available on request — email security@ultragent.ai.
Reporting a vulnerability
If you believe you have found a security issue, please email security@ultragent.ai. We appreciate responsible disclosure and will work with you to resolve it promptly.
Security questions or a customer security review? Contact security@ultragent.ai.