Security and governance at Agentman.
HIPAA, ISO 27001 and SOC 2 ready. Compliance audits underway.
This page says who can use a skill or an agent, what is logged, how your data is handled and where Agentman runs. If your reviewers need more, ask for our security documents.
Where the audits stand.
Our SOC 2 and ISO 27001 audits are underway, and neither has issued a report yet. Before any document is shared, we walk your security team through how it is handled.
You decide who can use, read, edit or administer each skill.
Access is set on the skill itself, so the person who owns a procedure decides who may run it and who may see how it works.
Roles
A skill has one owner. Everyone else is granted one of four levels: Use, Read, Edit or Admin. Publishing a version needs Edit; changing who has access needs Admin.
Per-skill permissions
Access is granted skill by skill, to a named teammate or to the whole workspace. Per-skill access control is on the Business plan.
Use-only skills
A person with Use access can run a skill and cannot read, export or clone it. Use-only sharing is on the Business plan.
Use-only sharing has its own page: the security model, how it was tested, and what it does not cover.
How use-only skills workWho used which skill, and when.
A reviewer's first question is who used what. These are the records Agentman keeps, and who can read them.
Every use of a skill
Each time a skill is applied, Agentman records who applied it, from which client, in which workspace and when.
Per-skill activity
Owners and admins see total applies, distinct users and the last use of each skill, with the events newest first.
Workspace access log
Workspace admins get one log across every skill in the workspace, filtered by skill, by user or by event type.
Version history
Every skill keeps its versions. You can compare two, see what changed and restore an earlier one.
What happens to your data.
Your skills are yours
The skills your team writes belong to your company. They stay in your workspace, and Agentman does not repackage them or share them with another customer.
Not used to train models
Agentman does not use your company’s data to train models.
Workspaces keep work apart
Each workspace has its own skills, members, permissions and logs. Many firms run one workspace per client or matter, with per-skill grants inside it.
If you leave
If you leave, we return your data within 30 days.
Where Agentman runs.
Agentman runs as a managed cloud service. On-premises deployment is available for Enterprise on request.
Healthcare and legal work.
Healthcare
Built for HIPAA. We sign a Business Associate Agreement before any patient data moves.
Medman is our product for independent medical practices, built on the same platform and live in practices today.
Legal
Firms keep matters apart by running one workspace per client or matter, and share a partner's method as a use-only skill so colleagues can apply it without reading it.
What security reviewers ask
Where do the SOC 2, ISO 27001 and HIPAA audits stand?
HIPAA, ISO 27001 and SOC 2 ready. Compliance audits underway. Our SOC 2 and ISO 27001 audits are underway, and neither has issued a report yet. Before any document is shared, we walk your security team through how it is handled.
Do you sign a Business Associate Agreement?
For healthcare customers, yes. Built for HIPAA. We sign a Business Associate Agreement before any patient data moves.
Who can see or change a skill?
Each skill has one owner, who grants a teammate one of four levels: Use, Read, Edit or Admin. Per-skill access control and use-only sharing are on the Business plan. A person with Use access can run a skill and cannot read, export or clone it.
What is logged?
Each time a skill is applied, Agentman records who applied it, from which client, in which workspace and when. Skill owners and admins see that activity per skill, and workspace admins see one access log across every skill in the workspace. Every skill also keeps its version history.
Is our data used to train models?
No. Agentman does not use your company’s data to train models.
Where does Agentman run?
Agentman runs as a managed cloud service. On-premises deployment is available for Enterprise on request.
What happens to our data if we leave?
If you leave, we return your data within 30 days.
How does our security team get your documents?
Use the “Request security documents” button on this page and tell us what your reviewers need. A person replies, and we walk your security team through how your data is handled before any document is shared.
Bring your security team.
We go through access, logging, data handling and deployment with your reviewers, and send the documents they ask for.
HIPAA, ISO 27001 and SOC 2 ready. Compliance audits underway.