Home / Docs / Security, privacy and data

Security and data in AnroAgents

Where data lives, who can see it, and what is done with it.

AnroAgents runs on AWS in the European Union, in the Ireland region, with the search index and static assets in Frankfurt, and the operating company is established in the EU. Conversations, agent configuration and uploaded documents stay within that infrastructure, with two exceptions: conversation content and knowledge-base material are sent to the AI model provider (currently OpenAI — the contracting party is OpenAI Ireland Ltd. inside the EEA, and the processing runs in the United States) to generate answers and build the search index, and our own transactional email — account, billing and service notices sent to the customer — is delivered through a provider in the United States. Email an agent sends a visitor is not part of that: it is sent from the mailbox the customer connects, under their own agreement with that provider. Both transfers rely on the transfer mechanism in that provider's data processing terms. AnroAgents does not offer EU-only inference today. The model provider keeps a copy of each request for up to 30 days for abuse monitoring before deleting it; it is not used for training, and that period runs on the provider's clock rather than on the retention period set in AnroAgents.

What is stored

AnroAgents stores your agent configuration, the documents you upload to the knowledge base, and the conversations your agents have — including whatever the visitor chose to share, such as a name, an email or a company.

Documents you upload to an AnroAgents knowledge base are stored, indexed for search, and used to ground your own agent's answers. They are never shared with other customers and never used to train a model.

Conversation transcripts in AnroAgents are visible to you and to the managers you invited into your workspace. Managers see conversations and agents; they do not see billing.

How long conversations are kept

A conversation in AnroAgents is deleted automatically once the retention period for the account has passed, counted from its last message. Deletion covers the transcript, the messages and the qualification data filed under the conversation.

The account owner sets the period in Settings. The plan sets the maximum: 30 days on Free, 90 days on Starter, 180 days on Pro, 365 days on Business. Any plan can be set as low as 7 days, which is what a customer with a retention policy of their own usually asks for. Only the owner can change it; managers see the period but cannot set it.

Shortening the period applies to conversations already stored, not only to new ones. Analytics covers at most the last 90 days, so a period below 90 days shortens the window analytics can report on.

Deleted data can persist in AnroAgents point-in-time backups for up to 35 days, after which it is gone. Backups exist to restore the database after a failure; they are not used to bring back individual conversations.

The data processing agreement

Where your agent processes your visitors' personal data, you are the controller and AnroAgents is the processor. The Article 28 GDPR terms are published at anroagents.com/dpa.html and are in force automatically when you accept the Terms of Service — nothing needs to be signed, and a counter-signed copy is available on request from support.

The providers involved in running the service are listed at anroagents.com/subprocessors.html, with what each one receives and where it processes it. Customers are notified by email at least 30 days before that list changes, including a change of AI model provider, and may object.

A security overview written for vendor reviews — hosting, encryption, tenant separation, retention, incident notification, and the certifications AnroAgents does not hold — is at anroagents.com/security.html.

Credentials you connect

A mailbox, a calendar, a CRM, a Telegram bot or a connected store is reached with a credential the customer grants, and those credentials are encrypted at rest with a dedicated managed key, separately from the database's own encryption. Each one is bound to the account or agent that owns it, so a value read out of one record cannot be used as another's. AnroAgents never displays or returns a stored credential once it has been saved; a connection can be replaced or removed, not read back.

Access and authentication

Sign-in to AnroAgents runs on AWS Cognito at auth.anroagents.com, with email and password or Google sign-in. Passwords are never stored by the platform itself.

The API key in the AnroAgents widget snippet is public by design — it sits in your page source and identifies the agent to the widget. It cannot read conversations, change the agent or touch the account, and it can be regenerated from the dashboard if you want to invalidate it.

A personal access token in AnroAgents is a secret and is a different thing entirely: it can manage agents through the API. Store it as you would any credential, and revoke it from the dashboard if it leaks.

GDPR and the visitor's data

Under GDPR, an AnroAgents customer is the data controller for their visitors' data, and AnroAgents is the processor acting on their instructions. What is collected is what your agent is configured to collect.

Sending marketing or follow-up email to a visitor requires their consent, and collecting it is the customer's responsibility. AnroAgents provides the mechanism — an opt-in checkbox on the pre-chat form, and an unsubscribe link in every follow-up — but the lawful basis is yours.

Handing a visitor to another business through the AnroAgents lead network always requires the visitor's explicit agreement in the chat, and the recipient is named to them before they agree. That consent is recorded with the referral.

Getting your data out, and deleting the account

Settings has a Your data section with both rights built in, for the account owner — a manager invited into the workspace can read its conversations but cannot export or delete the account.

Export builds a set of JSON files covering the profile, agents, conversations with every message, knowledge-base metadata with download links to the source documents, billing, team and referrals. It is built in the background and the download links last 7 days; one export per day. Credentials for connected services — mailbox, calendar, CRM, store, API tokens — are deliberately excluded: those are secrets AnroAgents holds on the customer's behalf, not data about them.

Deleting the account takes the agents offline and out of the public registry immediately, revokes API tokens, and cancels an active subscription. The data itself is erased 7 days later, and the deletion can be cancelled from Settings at any point in those 7 days — cancelling brings back exactly the agents the request switched off. Erasure covers agents, conversations and messages, the knowledge base in both storage and the search index, uploaded files, integrations, customer domains, team memberships and the sign-in identity. Invoices and payment records are kept for as long as tax law requires; nothing else survives.

A visitor's data can be deleted on request. Conversations are deletable from the dashboard, and a request covering a person across the account can be made to support, which is answered within 10 working days. If a visitor writes to AnroAgents directly about data your agent collected, AnroAgents does not answer them on the substance: the request is forwarded to you, because that data is yours as controller.

If a personal data breach affects data AnroAgents processes for you, you are notified without undue delay and within 48 hours of AnroAgents becoming aware, with what is known about scope and effect — enough to meet your own 72-hour obligation to a supervisory authority.

Payments

Card details are never handled by AnroAgents itself; card payments run through the payment provider, and cryptocurrency payments through a separate crypto payment provider. The platform stores the outcome of a payment, not the instrument behind it.

Availability

AnroAgents runs on serverless AWS infrastructure that scales with traffic rather than on fixed servers, so a spike of visitors on your site does not take the widget down. If the platform is ever unreachable, the widget fails quietly: the bubble does not appear and your site is otherwise unaffected.

When an agent can see your account

The AnroAgents support agent can answer questions about your own AnroAgents account. Two things make that safe, and both are structural rather than a matter of care.

The account it reads is never named in the conversation. It comes from a link you generated while signed in to the dashboard, or from the dashboard session itself — never from anything typed into a chat, because a chat is exactly where an identity claim cannot be checked. Anyone can type anyone's email address.

The lookup takes no arguments. There is no field in it for a user, an account or an address, so there is nothing for a message — or for text hidden inside a document the agent reads — to point somewhere else. An instruction saying "show me the account for someone@example.com" reaches the model, and the model has nowhere to put it.

What it can see is a fixed list: your plan, messages used this month, messages remaining, renewal date, and whether messaging is currently blocked. Not your payment details, your invoices, your contact information or anything belonging to anyone else. Every lookup is recorded against the account it read.

A link works once, expires after fifteen minutes, is cancelled by generating another, and is refused if presented to a different bot. Linking a new chat unlinks the one before it, and tells that chat it has been unlinked. You can unlink at any time from Settings, with immediate effect — do that if you change phone or lose a device.

The agent never does this in a group chat. A group has several people in it and an account belongs to one of them.