We take the security of your customer data seriously. This page describes the controls in place today. We don't claim certifications we don't hold.
Independent assessments
- Google CASA Tier 2: ultragent has completed Google’s Cloud Application Security Assessment (CASA) at Tier 2, the independent security assessment Google requires for apps that access Gmail data.
- SOC 2: Our SOC 2 audit is underway. We will update this page when the report is issued.
Authentication & access
- Two-factor authentication: any user can enrol an authenticator app (TOTP) with backup codes. Once enrolled, every sign-in asks for the code before a session exists. On Enterprise, workspace owners can require every member to enrol.
- Single sign-on (SSO): SAML 2.0 and OIDC for Enterprise organisations, with automatic provisioning into your workspace.
- Role-based access control: organisation roles (owner, admin, manager, member, viewer) control who can manage the workspace, its members and billing. Access to individual records follows ownership, team membership and explicit sharing.
- Verified sign-in: every account signs in through a verified channel — an emailed magic link, Google or Microsoft, or your company SSO. There are no passwords to leak or reuse.
Data protection
- Encryption in transit: all traffic is served over TLS 1.2 or higher, with HTTP Strict Transport Security.
- Encryption at rest: the database (MongoDB Atlas), stored files and backups are encrypted at rest. OAuth tokens are additionally encrypted at the field level with AES-256-GCM.
- Your data rights: you can export or delete your data at any time, consistent with GDPR and CCPA.
- No training on your data: we do not use your data, or any Google user data, to train generalised AI models. Our AI providers process your content only to deliver the feature you use, not to train their own models.
Email and calendar access
- Nothing is sent without you: ultragent drafts emails; a person approves every email before it leaves your mailbox. Nothing is sent from your mailbox automatically.
- Google API Limited Use: our use of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements (see our Privacy Policy).
- Disconnect any time: disconnecting a mailbox stops all syncing and deletes the access credentials we store for it. Email and calendar data already synced is erased when you delete it or delete your account.
Monitoring & audit trail
- Tamper-evident audit log: security-relevant events — sign-in, access and role changes, resource sharing, and administrative actions — are recorded in a hash-chained, append-only audit trail.
- Error & uptime monitoring: application errors and system health are continuously monitored. Live operational status is published at ultragent.ai/status.
Vulnerability management
We monitor our software dependencies for known vulnerabilities and remediate on a regular cadence, prioritising high-severity issues.
Sub-processors
We rely on a small set of infrastructure and service providers to operate ultragent. A current sub-processor list is available on request — email security@ultragent.ai.
Reporting a vulnerability
If you believe you have found a security issue, please email security@ultragent.ai. We appreciate responsible disclosure and will work with you to resolve it promptly.
Security questions or a customer security review? Contact security@ultragent.ai.