---
title: "Security · Agentrail"
description: "Technical and organizational measures Agentrail uses to protect customer personal data, including encryption, access controls, and logging."
canonical: "https://www.agentrail.co/security"
---

Legal

# Security

Updated October 19, 2026

This page describes the technical and organizational measures Agentrail uses to protect Company Personal Data. The [Data Processing Agreement](https://www.agentrail.co/dpa) incorporates it (Section 4.2 and Annex I). It covers the Services. The [privacy policy](https://www.agentrail.co/privacy) covers this website.

Aeternus Inc., 8 The Green, Ste A, Dover, Kent County, Delaware 19901, operates the Services as Agentrail. Questions about these measures: [privacy@agentrail.co](mailto:privacy@agentrail.co).

## Encryption

Company Personal Data is encrypted in transit and at rest. Transport uses TLS. Data stored for the Services is encrypted by the infrastructure that holds it.

## Access

Access to Company Personal Data is limited to personnel who need it to provide, secure, or support the Services. Access is granted on that need, and removed when the need ends. People with access are bound by confidentiality obligations.

## Logging

Agentrail logs access to the systems that store Company Personal Data, so that access can be reviewed. Logs are used to operate, secure, and support the Services.

## Subprocessors

Company Personal Data is processed by the [subprocessors](https://www.agentrail.co/subprocessors) named for the Services. Today those are Amazon Web Services, for cloud infrastructure, and Inngest, for durable workflows and background jobs. Each is bound by written data protection terms equivalent to the DPA. Agentrail gives at least fourteen days’ notice before a new Subprocessor processes Company Personal Data.

## Anonymization

When Agentrail creates Anonymized Data and Failure Insights under Section 3 of the DPA, it removes or masks names, contact details, IP addresses, account identifiers, credentials, API keys, and other secrets. It does not name the Company or its end users as the source without prior written consent. It does not attempt to re-identify Anonymized Data, except to test the anonymization process. Each AI Research Partner is contractually prohibited from re-identifying any individual or the Company. Company Personal Data that has not been anonymized is not disclosed to an AI Research Partner.

A customer may opt out of Section 3, for all or specified data, by emailing [privacy@agentrail.co](mailto:privacy@agentrail.co). Agentrail implements that opt-out within ten business days, as the DPA describes.

## Incidents

If Agentrail becomes aware of a Personal Data Breach affecting Company Personal Data, it notifies the Company without undue delay, provides the information the Company reasonably needs to meet its own notification duties, and takes reasonable steps to contain and remediate the breach.

## Deletion

When the Services end, and when the Company asks, Agentrail deletes or returns Company Personal Data, unless the law requires it to be kept. That duty does not apply to Anonymized Data or Failure Insights.

## Contact

Security and privacy questions about the Services: [privacy@agentrail.co](mailto:privacy@agentrail.co), or [Contact](https://www.agentrail.co/contact).