One operating layer. Deliberate control at every layer.
Agorix brings customer data and operational work into one connected platform. Our security approach focuses on controlling access, protecting data, governing agent actions, monitoring the service, and helping customers configure the platform responsibly.
Security starts with architecture
Agorix connects events, learning, CRM, marketing, commerce, workflows, analytics, knowledge, and AI-assisted work around one customer record.
That shared architecture can reduce uncontrolled copies and fragile point-to-point transfers. It also makes access, configuration, and governance especially important. Security is treated as an operating responsibility across the product, infrastructure, team, vendors, and customer workspace—not as a badge added after the fact.
Identity and access control
Agorix uses account and workspace controls designed to limit access to authorized users.
- Workspace-level user access and role-based permissions
- Authentication through Laravel Fortify-backed account flows
- Administrative controls for inviting, removing, and managing users
- Production access limited to authorized personnel with an operational need
- Role and workspace boundaries intended to keep customer operations appropriately scoped
Assign the least access each user needs, remove access promptly when responsibilities change, and protect all credentials and connected accounts.
Data protection
Agorix uses infrastructure and service controls intended to protect customer data throughout its lifecycle.
- Encryption in transit for supported service connections
- Infrastructure protections for stored production data
- Backup practices designed to support service recovery
- Logging and monitoring used for operational and security visibility
- Vendor review and contractual protections appropriate to the services providers perform
- Processes for handling access, support, and operational needs
No online service can promise absolute security. Specific encryption, backup, recovery, retention, and deletion commitments should be confirmed in the current customer agreement and security materials.
An agent should have enough access to do the job—and no more.
The Agorix AI Operator can use approved business context and work across connected platform modules. Governance controls are designed to keep that capability visible and bounded.
- Define which workspace context an agent may use.
- Control the modules and actions available to the role or workflow.
- Require human approval before customer-facing or consequential work proceeds.
- Review what the agent prepared, what a person approved, and what action followed.
- Limit sensitive data to what the task actually requires.
Monitoring and auditability
Agorix uses application, infrastructure, and operational signals to monitor service health, investigate anomalous behavior, troubleshoot issues, and maintain visibility into important activity.
Product-level histories can help teams understand how workflows and agent-assisted work progressed. The precise events, retention periods, customer access, and export capabilities depend on the implemented feature and plan and should be confirmed during review.
Reliability and recovery
Agorix maintains operational practices intended to support availability, backup, recovery, and continuity. Recovery priorities account for the connected nature of customer records, campaigns, events, commerce, learning, workflows, and related services.
Security reviewers can request current information about hosting, backup practices, recovery objectives, availability commitments, and incident handling when available. Do not infer contractual service levels from this overview.
Vendor and subprocessor management
Agorix relies on providers for functions such as infrastructure, hosting, email, analytics, payments, support, monitoring, security, and AI model services. Providers are evaluated based on the nature of their access and service, and contractual protections are expected to limit processing to authorized purposes.
Customers can request the current subprocessor information and DPA materials available for review.
Secure product development
Security considerations should be part of designing, implementing, reviewing, deploying, and maintaining the Agorix service. The current security package should accurately describe practices for source control, code review, dependency management, vulnerability handling, environment separation, change management, and security testing.
Incident response
Agorix maintains a process for identifying, containing, investigating, remediating, and learning from security incidents. If an incident affects customer data, Agorix communicates with impacted customers according to applicable law and the controlling agreement.
The security and legal teams should keep notification timing, contact channels, escalation responsibilities, and DPA commitments aligned with the operational response plan.
Shared responsibility
Agorix protects and operates the service. Customers control important parts of how their workspace is used.
Customers should:
- Assign appropriate roles and review access regularly.
- Remove users and connected credentials promptly when access is no longer needed.
- Use strong authentication practices supported by the product.
- Configure integrations, campaigns, workflows, and approval gates carefully.
- Review AI-generated work for accuracy and sensitive use cases.
- Collect and use customer data lawfully and limit it to what the operation requires.
- Maintain the security of endpoints, email accounts, identity providers, and third-party systems they connect.
- Report suspected misuse or vulnerabilities promptly.
Security review FAQ
Does Agorix encrypt data?+
Agorix protects supported connections with encryption in transit and uses infrastructure protections for stored production data. Request the current security materials for implementation details and contractual commitments.
Can every user see the entire workspace?+
Agorix provides workspace access and role-based permissions. Administrators are responsible for assigning appropriate access. Confirm the current permission granularity for the modules and roles in scope.
Can the AI Operator publish work on its own?+
Agent access and approval behavior depend on the configured policies, permissions, and workflow. Customer-facing or consequential actions should use visible human approval gates appropriate to the use case.
Does Agorix use subprocessors?+
Yes. Providers support infrastructure, email, analytics, payments, support, monitoring, security, and AI model services. Request the current subprocessor information and DPA for details.
Is Agorix certified against a security standard?+
Only certifications and independent assessments included in the current security package should be treated as verified. This draft intentionally makes no SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR, or similar certification or compliance claim.
How do I report a security concern?+
Contact hello@agorix.com with the subject line “Security.” Do not include secrets, credentials, or unnecessary personal data in the initial message.
Bring us your review requirements.
Request the security, privacy, and data-processing information currently available for your evaluation of Agorix.