Augmetaaugmeta
Book a demo
Security & posture

We earn trust by how we handle your data.

Augmeta connects to your most sensitive business systems — analytics, warehouse, product data. That access comes with responsibility. Here is exactly how we handle it.

Core principles
Isolated by design
Every organization operates in a strict data boundary. Users only access what belongs to their team. No cross-tenant leakage, no shared state.
Encrypted at every layer
Credentials, data in transit, and data at rest are encrypted with industry-standard algorithms. Secrets are never stored in plaintext.
Least privilege everywhere
Access defaults to private. Team members see only their own work unless an admin grants broader visibility. Every API call is scoped to the active organization.
Credential protection

Encrypted before it hits storage.

When you connect an integration, the credentials are encrypted before they ever hit storage. They are decrypted only at the moment of execution, held briefly in memory, and never logged.

Encryption specification
AlgorithmAES-256-GCM
Key length256-bit
IV generationrandom, per operation
AuthenticationGCM auth tag
TransportTLS 1.2+
Infrastructure

Managed, US-hosted infrastructure with strict network boundaries between tenants and service layers.

Cloud hosting
Application services run on AWS (US regions) and Railway, with isolated compute for each service layer.
Database
PostgreSQL with encrypted connections. Organization-scoped queries enforce tenant isolation at the data layer.
AI compute
Agent workloads run on LangGraph Cloud. Models are invoked via API — no customer data is stored by model providers.
Vector storage
Embeddings live in Pinecone with namespace-level isolation per organization. Documents are never shared across tenants.
AI & data governance

Augmeta’s agents analyze your data to surface opportunity gaps and root causes. That analysis is scoped to your organization, and your data is never used beyond that purpose.

No model training on your data
We use third-party LLM providers (OpenAI, Anthropic, Google) via API. All are contractually prohibited from training on your inputs or outputs. Your data is processed and discarded.
Full observability
Every agent action is traced and logged. You can inspect what data was accessed, what reasoning was applied, and what came back. No opaque decisions.
Scoped data access
Agents only touch the integrations you explicitly connect — nothing is crawled, scraped, or inferred beyond what you authorize. Integrations can be disconnected instantly.
Access control

Organization-level isolation and role-based permissions, with authentication handled by Clerk.

Organization isolation
Every resource is bound to a single organization. Queries are scoped at the organization level, making cross-tenant access architecturally impossible.
Private by default
Members see only their own work; admins have full visibility across the org. There is no "public" default — visibility is opt-in and role-controlled.
Authenticated API access
Every request is authenticated via JWT with organization and role claims. Service-to-service calls use dedicated, scoped API keys.
Session management
Sessions are managed by Clerk (itself SOC 2 Type II certified): short-lived tokens, automatic refresh, device-level revocation, MFA available.
SOC 2 Type II — in progress, monitored by Oneleet

SOC 2 Type II

Our SOC 2 Type II audit is underway, monitored continuously through Oneleet — controls for security, availability, and confidentiality over an extended observation period, not a point-in-time snapshot. Need a security review, a completed questionnaire, or early access to the report?

Request the vendor pack
Report a vulnerability
Found a security issue? We appreciate responsible disclosure and will work with you to understand and address it quickly.
security@augmeta.ai
Enterprise security review
Bringing Augmeta to your organization? We’ll complete security questionnaires, share architecture documentation, and work through your procurement process.
Get in touch