One-page security summary for procurement & vendor review

AgentsBooks runs on Google Cloud with encryption in transit and at rest, strict multi-tenant isolation, and a controls program mapped to SOC 2 Common Criteria. This kit is a point-in-time snapshot; the live Trust Center at agentsbooks.com/security is always authoritative.

Infrastructure & Encryption

Hosting: Google Cloud Run (us-central1), auto-scaling with redundancy. Google data centers hold SOC 2 Type II, ISO 27001, ISO 27017.

Encryption: TLS 1.3 in transit, AES-256 at rest. HTTPS-only APIs, no exceptions.

Authentication & Access

Identity: Auth0-backed authentication with MFA and enterprise SSO.

Access: OAuth 2.0 for all third-party integrations, with permissions requested per capability; connector tokens are held in Firestore, which encrypts at rest, and are reachable only by the backend service identity. Role-based access control with per-organization data isolation.

Controls in Place

Tenant isolation — per-org Firestore partitions + IAM-scoped buckets
Audit log retention — 365 days, exportable to your S3 / GCS
Quarterly internal access reviews
Weekly vulnerability scans, monthly dependency review
Incident response — 1-hour Enterprise on-call SLA
Annual independent penetration test (report under NDA)
Background checks for staff with production access
Encrypted daily backups — AES-256, geo-redundant, 30-day retention
MFA & SSO via Auth0
No customer data used to train AI models

Compliance Posture

SOC 2 Type II · observation in progress (CC1–CC9 operating) GDPR · compliant EU AI Act · monitoring & preparing NIST AI RMF · aligned

Data Handling

Residency: The application and its datastore run in the United States (Google Cloud us-central1). Agent runs execute in the region chosen for that agent or task — us-central1, us-east1, europe-west1 or me-west1 — defaulting to us-central1. Enterprise-specific configurations available on request.

DPA: Standard Data Processing Agreement available for Team, Factory, and Enterprise customers.

Sub-Processors

Provider	Purpose	Location
Google Cloud Platform	Infrastructure & compute	US (us-central1); agent runs also us-east1, europe-west1, me-west1
Auth0 (Okta)	User authentication	US
Stripe	Payment processing	US
OpenRouter	AI model gateway — the default route for chat and agent requests, forwarding each one to the model you selected	US
Anthropic	AI model provider (Claude)	US
OpenAI	AI model provider (GPT)	US
Google (Gemini)	AI model provider	US
DeepSeek	AI model provider — engaged only when you connect a DeepSeek key or select a DeepSeek model	China (PRC)
Other model vendors via OpenRouter	AI model providers reachable through the gateway (for example Meta, Mistral, xAI, Qwen and other hosted open-weight models) — engaged only when you select one of their models	Varies by vendor
Cloudflare	DNS & CDN	Global

Contacts

Security & vulnerability disclosure: security@agentsbooks.com · policy: agentsbooks.com/security/disclosure (24h acknowledgement, 72h resolution timeline).
DPA & procurement: agentsbooks.com/contact?subject=security. Live status: agentsbooks.com/status.