Welcome to the Automatiq.ai Trust Center
Our agents read and write the systems that run your business, so how we handle your data is not a footnote. This page sets out what we are certified against, the controls we operate, who else may touch your data, and what you can ask us for.
If your security or procurement team needs something that is not here, contact us and we will answer directly rather than send you to a portal.
Organizational controls
- Information security policy approved and reviewed
- Security roles and responsibilities defined
- Segregation of duties applied
People controls
- Background verification before employment
- Security responsibilities in employment terms
- Confidentiality agreements signed
Physical controls
- Production hosted in certified data centres
- Physical access to facilities restricted
- Secure disposal of equipment and media
Technological controls
- Least privilege access, reviewed periodically
- Multi-factor authentication on administrative access
- Agents inherit your own permission model
The 33 controls below sit inside our ISO/IEC 27001 information security management system, grouped by the themes the standard uses.
Organizational controls
- Information security policy approved and reviewed
- Security roles and responsibilities defined
- Segregation of duties applied
- Asset inventory maintained
- Information classified by sensitivity
- Supplier security assessed before engagement
- Data protection terms in supplier contracts
- Incident response process documented
- Business continuity and recovery tested
People controls
- Background verification before employment
- Security responsibilities in employment terms
- Confidentiality agreements signed
- Security awareness training for all staff
- Access revoked on role change or exit
- Disciplinary process for security breaches
Physical controls
- Production hosted in certified data centres
- Physical access to facilities restricted
- Secure disposal of equipment and media
- Clear desk and clear screen practice
Technological controls
- Least privilege access, reviewed periodically
- Multi-factor authentication on administrative access
- Agents inherit your own permission model
- Encrypted in transit using TLS and at rest
- Keys managed separately from the data
- No model training on customer content
- Zero data retention with model providers
- Agent actions and system access logged
- Logs protected against tampering
- Development and production environments separated
- Secure development practices followed
- Vulnerability management and patching
- Malware protection in place
- Backups taken and recovery tested
Current subprocessors
Each is bound by contractual data protection terms and receives only the data required for its function. Material changes are published under Updates.
| Subprocessor | Purpose |
|---|---|
 Amazon Web Services |
Cloud infrastructure and hosting |
 OpenAI |
Language model processing |
 Anthropic |
Language model processing |
 Google Gemini |
Language model processing |
 Cloudflare |
Network delivery and protection |
 Twilio |
Messaging delivery |
 019 |
Messaging delivery |
 Meta |
WhatsApp Business messaging |
 MongoDB |
Database hosting |
What counts as a subprocessor
Any third party that stores, transmits or processes customer data as part of delivering our service, including infrastructure providers and the model providers behind our agents. It does not include systems you already run and we simply integrate with, such as your own ERP or CRM, since that data never leaves your control.
Reviewed before engagement
Before a subprocessor is engaged we assess its security posture, the data it would touch and the region it operates in. Engagement depends on contractual data protection terms that hold it to standards no weaker than our own.
Kept to a minimum
We engage as few subprocessors as the service allows, and each receives only the data it needs to do its job. The model providers behind our agents operate under zero data retention, so customer content is not held by them after processing.
Changes to the list
The current list is provided to customers and to prospective customers going through a security review. Material changes are published under Updates and notified to customers under contract.
ISO/IEC 27001 certificate
Our current certificate is available on request, together with the scope statement describing exactly what the certification covers.
Security questionnaires
Send us the questionnaire your organisation uses and we will complete it. If your team would rather speak to the people who built the integration, we will arrange that too.
Subprocessor list
Provided to customers and to prospective customers under review. How the list is managed is described under Subprocessors.
Public documents
Our privacy policy and accessibility statement are published on this site and need no request. Links are in the footer of every page.
ISO/IEC 27001 certification achieved
We are pleased to announce that Automatiq.ai has officially achieved ISO/IEC 27001 certification, the international standard for information security management. The certification covers how we manage information security across our systems, our people and our suppliers, and it is maintained through regular audit. The certificate and its scope statement are available on request under Resources.
What gets published here
Changes to our certifications, additions or removals from the subprocessor list, changes to where data is processed, and any security incident affecting customer data.
How you are notified
Customers under contract are notified directly through their named contact, in line with the notice periods in their data processing terms. Anyone evaluating us can ask to be added to the same notifications.
Security incidents
Our incident response process covers detection, containment, customer notification and a review afterwards. Where an incident affects customer data, affected customers are contacted directly rather than left to find a notice on a page.