Angareion holds what your AI agents and your team remember. This page says how that data is protected, who handles it, and how to report a problem. It describes what is in place today, and says plainly what is not.
How your data is protected
- Every organization is isolated at the database. Customer data lives in tables protected by row-level security, which the database enforces for every query the application makes. The service refuses to start if its database role could bypass it.
- Sign-in. Passwords are stored only as salted hashes. Access tokens live in the browser's memory and are short-lived; the longer-lived refresh token is kept in an HTTP-only cookie that page scripts cannot read.
- Encrypted at rest. The storage volumes behind our databases, search index, queues and file storage on AWS, and the backups (snapshots) of them, are encrypted with AWS-managed keys, and encryption is switched on by default for every new volume in our AWS account. Third-party services listed below protect the data they hold under their own terms.
- Encrypted in transit. Every public Angareion site and API is served over HTTPS, and plain HTTP is redirected.
- An audit trail. Security-relevant actions, including sending output by email and exporting data, are recorded in an audit log.
- Secrets stay out of logs. Our web servers log request paths without query strings, and tokens that appear in URLs are redacted in our logs.
Your data, under your control
- Export. An organization admin can export everything in the organization (members, agents, projects, memories, outputs and the original documents) from Settings → Data export. Anyone can download a file of their own records.
- Deletion. An organization admin can delete the organization. It is scheduled with a 30-day grace period, during which any admin can cancel it, and is then permanently removed from every store that holds it: the database, search index, graph, file storage, analytics, caches, and the billing subscription.
- No sale of your data. See the Privacy Policy.
Subprocessors
These are the companies that handle data on our behalf. Our own databases, search index and queues run on AWS infrastructure and are not separate vendors. Last reviewed 2026-10-20.
Vendors that process the content you store
- OpenAI, L.L.C. — Creates vector embeddings for search and, on paid plans, extracts structured memories from ingested documents.
Receives: Text of memories, outputs and document chunks, and search queries. - Anthropic, PBC — Powers the guided specialist interviews and other composition features that you or your agents request.
Receives: The text of the conversation or content being worked on. - Amazon Web Services, Inc. — Hosts the Service: compute, block and object storage, container registry and email delivery (Amazon SES). Our databases, search index and queues run on this infrastructure.
Receives: All Customer Data, stored in the US East (N. Virginia) region, and the email we send you. - Neo4j Sweden AB — Hosts the managed graph database that stores how memories and outputs relate to each other.
Receives: Memory and output text, titles and the relationships between them.
Vendors that handle account, billing, diagnostic or visitor data
- Stripe, Inc. — Processes payments and subscriptions for paid plans through Stripe-hosted checkout and billing pages.
Receives: Billing contact email, organization name and the billing details you enter on Stripe. Card numbers go to Stripe and never reach Angareion. - Functional Software, Inc. (d/b/a Sentry) — Error monitoring, so we can find and fix crashes.
Receives: Error messages, stack traces and request paths. The browser reporter is configured not to send cookies, request bodies or user details. - Cloudflare, Inc. — DNS and traffic proxying for our public sites, and a bot check (Turnstile) on sign-up.
Receives: IP address and request metadata of visitors; the sign-up bot check also sees a browser challenge response. - Google LLC — Serves the typefaces used by our websites and the app.
Receives: The visitor’s IP address and browser details, sent by the visitor’s browser when it loads the fonts. - Plausible Insights OÜ — Cookie-free, aggregate analytics for the marketing site and the signup and onboarding pages of the app.
Receives: Page views and a small set of events, without cookies or personal profiles.
Status: Not used inside the signed-in product. On the app it records only the signup and onboarding pages and the account-created event.
If you connect your own third-party account (for example a Firecrawl key to crawl web pages), the data you direct to it goes to that provider under your own account; it is not an Angareion subprocessor.
Compliance
Angareion does not yet hold a SOC 2 report or an ISO 27001 certificate. SOC 2 is on our roadmap. Until then, the practices on this page are our own, not an auditor's findings, and we are glad to answer a security questionnaire at security@angareion.com.
Reporting a vulnerability
If you believe you have found a security problem in Angareion, email security@angareion.com with what you found and how to reproduce it. Please give us a reasonable chance to fix it before you share details publicly, and do not access data that is not yours or disrupt the service while testing. We will not pursue legal action against good-faith research that follows these rules. Our contact details are also published in security.txt.