- Home
- Trust
AI agent security and data privacy: every layer we run, with what is still partial.
Written for your data protection officer, your security team and your procurement checklist. Each layer says what we do today, what is partial and what comes next. There are no badges on this page, because we hold no certificate yet.
- Hosted in Nuremberg, Germany
- Model route and region named per deployment in your contract
- Sub-processors listed and dated
The layers around every agent
Pick a layer. Its drawing plays once and shows only what really happens on the platform today. The “partial” list is the part a sales page usually leaves out.
Access and identity
GDPR Art. 32AI Act Art. 14A person sets what an agent may do. The agent’s own specification, which the AI helps write, can narrow that, never widen it.
The agent gets only the overlap of the grant a person set and what its specification asks for. A wider request is refused.
What we do today
- Sign-in with Google, with a verified email address only.
- Sessions end after 12 hours, in a secure, same-site cookie.
- API keys are stored only as one-way digests, belong to one agent, and stop working the moment they are revoked.
- Our team reaches the servers only with SSH keys, over a private network.
What’s partial
- Anyone with a verified Google account can open a free platform account. Your workspace stays separate (layer 02), but sign-up is not invitation-only today.
- The platform has no second factor of its own: strong sign-in depends on the Google account’s settings.
- No single sign-on with your identity provider (SAML, Entra, Okta) yet.
What’s next
- A second factor for our administrators and operators.
- Single sign-on with your identity provider.
Separation between clients
GDPR Art. 32Art. 28(3)(c)Every record, file and search index belongs to one client, and every query is filtered by who is signed in.
An agent in workspace A reaches only A’s records. B’s answer “not found”. A live agent runs in its own containers with its own database.
What we do today
- Every row carries its client, and every query, file and knowledge search is filtered by the signed-in identity.
- Each live agent runs in its own containers, with its own database and credential store.
- A credential belongs to one workspace; asking for another workspace’s credential is refused and written down.
What’s partial
- While an agent is built and tested, the separation is in the application, in one shared database. The database itself does not enforce it per row.
- The separation was reviewed internally, not by an independent tester.
What’s next
- An independent penetration test with tenant-separation cases.
Hosting, network and encryption
GDPR Art. 32The platform runs at Hetzner in Nuremberg, Germany. It accepts no direct web connections, and everything it sends travels encrypted.
The servers open no inbound web ports. Answers leave through an outbound tunnel to the HTTPS edge. Credentials are sealed on the server.
What we do today
- All traffic to you is HTTPS, with HSTS. Calls to providers use HTTPS too.
- The server opens no inbound web ports; public traffic arrives through an outbound tunnel.
- Credentials you give us are sealed with authenticated encryption tied to their owner, and can’t be read back through any interface.
- A weak or placeholder secret stops the platform from starting.
What’s partial
- Stored data in general (the database, documents and backups) is not encrypted at rest yet. Only credentials are.
- Master keys are kept offline by hand; there is no key management service, and rotation is manual.
- Some host-hardening items are open. We list them in the security pack, not on a public page.
What’s next
- Encrypted volumes for the database and files, and encrypted backups.
Only the data the task needs
GDPR Art. 5(1)(c)Art. 25An agent reaches only the systems its approved specification connects. Secrets are removed before the model or the records see a tool’s answer.
The agent reads the two sources it was given. A key in a tool’s answer is replaced before the model sees it. Personal data is not masked today.
What we do today
- An agent can use only the tools and sources its approved specification declares.
- Secret-shaped strings and stored credential values are scrubbed from tool results, streams and records.
- Content is kept out of our telemetry by default.
- A website visitor sees only the answer and its sources, never tool details or approvals.
What’s partial
- Personal data is not masked or redacted before the model. Names, bank details and health data in a document reach the model as they are, so we connect only what the task needs.
What’s next
- Optional masking of personal data before the model, per deployment.
The model step
GDPR Art. 28(2)Art. 44The model call is the one step that leaves our servers. Its provider, route and region are named per deployment in your contract.
The request crosses the edge of our servers to the model provider in your contract, and comes back. The call is recorded before it is sent.
What we do today
- Each deployment names its model providers.
- Every model request is admitted and recorded before it is sent.
- We don’t use your data to train models.
What’s partial
- The route and region are not settled yet. Today’s model calls go through a routing gateway whose hosting and upstream we are still documenting, so we don’t promise that the model step stays in the EU.
- No zero-retention or no-training setting is sent with provider calls; those terms depend on each provider’s contract.
What’s next
- A direct provider account in a named region for each client deployment, written into the DPA.
- Provider terms that exclude training, and shorter retention where a provider offers it.
Untrusted content and testing
AI Act Art. 15Documents, web pages and tool results are data for the agent, never instructions. Before release, every agent faces a safety pack it must pass in full.
A document hides an order to “ignore your rules”. It is read as data, the agent’s task doesn’t change, and the injection cases in the safety pack must all pass.
What we do today
- Retrieved content and tool results are labelled untrusted; hidden and direction-changing characters are stripped.
- The server keeps the conversation, so a made-up history or tool result is not accepted.
- Code an agent writes runs in a locked container: no network, a read-only system, no privileges.
- A safety pack runs before every release: injection in pages and tool results, another customer’s data, writes without approval, budget stops. Every case must pass and can’t be waived. The pass bar is at least 80%.
What’s partial
- The scan for known injection patterns in knowledge and memory is not exhaustive.
- Our security reviews so far were internal. There has been no independent penetration test.
- No automated code, dependency or secret scanning runs on each change yet.
What’s next
- An independent penetration test that includes prompt-injection and tool-misuse cases, with a summary letter.
- Secret scanning, dependency audits and image scanning on every change.
A person decides
AI Act Art. 14GDPR Art. 22Any action that changes something outside the agent waits for a named person. The approval covers exactly that action, once, and expires.
Sample: the agent proposes a payout and stops. A claims handler approves it; the approval, its scope and its expiry go on record.
What we do today
- A write waits for a person. Each approval is tied to the exact action and tool version, used once, and replaced if the request changes.
- A named person approves every release.
- Visitors and API callers can never approve anything.
- An agent can be stopped at once, a single run can be cancelled, and spending caps apply per day and per run.
What’s partial
- For a live agent on the platform, held actions are approved by our operator today, not on a screen of yours. In a client build, the approval step is wired into your own system.
What’s next
- An approval screen for your own people on live agents.
Every run on record
AI Act Art. 12Art. 26(6)Every run is recorded step by step: what came in, which sources and tools were used, which model, and who approved.
Sample record: each step writes its line as it happens. The approver’s line is written by a person’s decision.
What we do today
- A durable record of every run’s steps. A read that is audited is written before the tool runs.
- Approvals keep who asked, who decided, what it covered and when it expires.
- Every use of the credential store is logged, without the secret.
What’s partial
- The records are append-only by design, but not tamper-evident: there is no hash chain or write-once storage.
- There is no audit screen or export for you yet; we provide extracts on request.
- Our team’s access to your data is governed by policy and the DPA; the platform does not log each read yet.
- No timed retention: records are kept until they are erased.
What’s next
- A tamper-evident trail, an audit view and an export for you.
- Logged, approved access for our operators.
Deletion, export and backups
GDPR Art. 17Art. 5(1)(e)Art. 28(3)(g)An agent and its data can be erased with a receipt for every step. What isn’t automatic yet, we do by hand, on request.
You ask; each store is erased in turn and gets its line on the receipt. Copies in backups are not part of that receipt yet.
What we do today
- Deleting an agent erases its conversations, runs, files, knowledge, credentials, memory and keys, with a receipt for each step.
- A full backup before every release, plus our host’s server backups, and an automatic rollback if a release fails its checks.
What’s partial
- Export of your data is manual, on request. There is no download button yet.
- A live agent’s own database and a whole account are erased by hand, on request, within 30 days.
- Backups stay with our host, are not encrypted, and a restore has not been drilled yet.
What’s next
- Nightly encrypted backups in a second location, with a recorded restore drill.
- A retention period you set per workspace, and a self-service export.
Checked against the platform’s code and our hosting notes on 11 November 2026. We update this page when a line moves from partial to done.
One agent, drawn from end to end
Every agent we build gets this drawing, filled in with its own systems, model route and retention, as part of its documentation.
- Your systems: the agent reads only what you allow.
- Scrubbing: keys and stored secret values are removed from what the model and the records see. Personal data is not masked today; the agent reads only the systems you connect.
- The Wise Agents platform, hosted in Nuremberg, Germany: the agent, the knowledge from your documents, the record of every run and your test cases. Erased on request.
- The model route: the model provider, route and region are named per deployment in your data processing agreement. The model step is not promised to stay in the EU.
- A person: your reviewer decides payouts, refusals and anything that matters.
The path of one agent, drawn. The model step is the one part outside our own servers, so it is named per deployment rather than promised in general.
No certificates today. Here is what that means.
Not certified yet. We’re working towards ISO/IEC 27001 and ISO/IEC 42001, and we use their requirements to shape how we work. The certificate will be shown here once an accredited auditor issues it.
- We hold no ISO/IEC 27001 or ISO/IEC 42001 certificate, and no SOC 2 report. No auditor has examined us yet.
- There is no general “GDPR certificate” and no AI Act certificate for this kind of use. Certification schemes under GDPR Art. 42 exist, but they don’t reduce a processor’s duties, and we hold none.
- Our hosting provider, Hetzner, holds ISO/IEC 27001:2022 for its data centre parks, including Nuremberg. That is Hetzner’s certificate, not ours.
If your procurement needs a certificate, tell us in the scoping call. We will say plainly whether we can meet it, and by when.
You are the controller. We are your processor.
For the agents we run, you decide why and how personal data is used; we process it on your documented instructions. The data processing agreement says so before any data moves.
The DPA, in plain words GDPR Art. 28(3)
The first page names the subject, the duration, the nature and purpose of the processing, the types of personal data and the groups of people. Then we commit to these eight things:
- (a)We act only on your documented instructions, including on any transfer outside the EU.
- (b)Everyone who handles your data is bound to confidentiality.
- (c)We apply the security of Art. 32: the nine layers above, with their partial lines, as the security annex.
- (d)Sub-processors only with your authorisation. You are told of a change in advance and can object, and we stay fully liable for them.
- (e)We help you answer people who use their rights: access, correction, erasure, objection.
- (f)We help you with security, breach notices, impact assessments and prior consultation (Arts. 32–36).
- (g)At the end, we delete or return your data, as you choose.
- (h)We give you the information to show all this, and allow audits and inspections.
Who else touches the data
The list for the platform, checked against its deployment files on 11 November 2026. Each agent’s DPA confirms the model provider and region for that agent.
| Sub-processor | What it does | What it receives | Where |
|---|---|---|---|
| Hetzner Online GmbH | Servers: the platform, its database and files, and each live agent | All stored data | Nuremberg, Germany |
| Cloudflare | DNS, the HTTPS edge and the tunnel to our servers | Traffic in transit, IP addresses | Global network; outside the EU possible |
| AI model service, through a routing gateway | Runs the language model for each step | The prompt, documents and tool results of that step | Region named per deployment in your contract |
| OpenRouter | Embeddings for knowledge search | Knowledge text and search queries | Outside the EU possible |
| WaterCrawl | Web search and page fetch, for agents that use it | Search terms and web addresses | Outside the EU possible |
| Sign-in | Name and email address | Outside the EU possible | |
| Stripe | Payments for platform accounts | Billing details | Outside the EU possible |
| Zoho Mail | Our mailbox, [email protected], for questions and security reports | Mail you send us | Canada (Zoho’s Canadian data centre) |
| Cloudflare Email Routing, to Google Gmail | Our inbound support mail | Mail you send us | Outside the EU possible |
We don’t promise one region for the model step: each deployment names its route and region in writing. A change to this list is announced in advance, so you can object (GDPR Art. 28(2)).
Transfers outside the EU
Your data is stored in Germany. Some sub-processors above, including the AI model service, may process data outside the EU. The DPA’s transfer annex names the legal basis for each one (GDPR Art. 44):
- An adequacy decision (Art. 45). For US providers that take part in the EU-US Data Privacy Framework, that is the Framework’s decision. The EU General Court upheld it on 3 September 2025; an appeal is pending at the Court of Justice.
- Otherwise, the Commission’s standard contractual clauses (Art. 46(2)(c)). We keep them in place as the fallback in case the Framework falls.
We will say “EU-only” for the model step only once an EU route is set up and written into your contract.
Telling people it is an AI
AI Act Art. 50(1)Art. 50(5)Since 2 August 2026, people must be told they are dealing with an AI, at the latest at their first interaction, unless it is obvious. Every customer-facing agent we build opens by saying so, and the safety pack tests it.
Sample opening: “You’re writing to an AI assistant. A claims handler checks every decision.”
What your DPO, risk and procurement teams get
Available on request, before you sign. You own the assessments; we give you the inputs.
DPIA support pack
GDPR Art. 35Where processing is likely to be high-risk, you must assess it before it starts. The pack holds the agent’s data path, the categories of data and people, the retention per type, the sub-processors and model route, the risks we see with the controls from the nine layers (partial lines included), the test results, and the AI Act risk classification.
DORA and NIS2 supplier annex
DORA Art. 30NIS2 Art. 21(2)(d)For banks, insurers and other financial entities, and for essential and important entities: a clause annex covering the service description, where data is processed and stored, security and availability, sub-contracting, help in an incident, your audit and access rights, termination rights and an exit plan. Where your own clauses ask for something we can’t do yet, we say so before signing.
If a personal data breach happens
GDPR Art. 33Art. 34- We tell you without undue delay once we are aware: what happened, which data and people, what we have done.
- Within 72 hours of your awareness you notify your supervisory authority where required. We give you what you need for it.
- If the risk to people is high you tell them without undue delay; we help.
Partial: our written incident response plan is not finished yet. It is the first item on our security list.
Ask for the documents
Sending opens your own email app with the request written out and addressed to [email protected]. Nothing is stored on this site.
Your email app should now open with the request to [email protected]. Press send there. If nothing opened, open the message again or write to [email protected].
Found a security problem?
Write to [email protected]. You get a first reply within three working days. Please don’t test against agents that serve our clients, and don’t access data that isn’t yours.
Machine-readable: /.well-known/security.txt
The pack is shared under NDA where it describes open hardening items.
What security reviews ask first
Is our data used to train models?
Not by us. For the model provider, the route in your DPA is chosen on terms that exclude training on your data, and we show you those terms. We don’t send a no-training or zero-retention setting with each call today; it rests on the provider’s contract.
Does our data stay in the EU?
Your documents, knowledge index, run records and test cases are stored in Nuremberg, Germany. The model step is different: its route and region are not settled yet, so they are named per deployment in your contract, and some sub-processors may process data outside the EU. We don’t promise that the model step stays in the EU until an EU route is set up for you.
Do you have zero data retention with the model providers?
No, not today. Zero retention needs a signed agreement with each provider, and we have none yet. Retention at the provider follows the terms of the route in your DPA.
Is our data encrypted?
In transit, yes: HTTPS with HSTS, and HTTPS to every provider. At rest, only credentials are encrypted today. The database, documents and backups are protected by access controls but not encrypted at rest yet; encrypted volumes and backups are next on our list.
Do you support single sign-on and a second factor?
Sign-in is with Google, so a second factor depends on your Google account’s settings. Single sign-on with your own identity provider, and a second factor of the platform’s own for our operators, are planned and not built.
Has the platform been penetration-tested?
Not by an independent tester yet. It has had structured internal security and tenancy reviews, and every agent passes a safety pack before release. An external test with prompt-injection and tool-misuse cases is planned; we will share its summary letter.
Are you certified?
No. We hold no ISO/IEC 27001, ISO/IEC 42001 or SOC 2 report or certificate, and show no such badge. Our host Hetzner holds ISO/IEC 27001:2022 for its data centres; that one is theirs.
How fast will you tell us about a breach?
Without undue delay once we are aware, with what we know, so you can meet your own 72-hour notice to the supervisory authority (GDPR Art. 33). We don’t promise an hour figure we can’t back with a written plan yet.
Who at Wise Agents can see our data?
Only the people who build and run your agent, bound by the confidentiality terms of the DPA. Their names and roles are listed in the proposal. Today that access is governed by policy; the platform doesn’t log each read yet.
Can we get our data back, and have it deleted?
Yes. Export is manual today: we prepare it on request. An agent and its data can be erased with a receipt for each step; a live agent’s own database and a whole account are erased by hand within 30 days of your request.
Bring one process. Leave with a risk class, a pass bar and a plan.
A 45-minute scoping call with the people who would build it. You get a first view of the AI Act risk class, the controls it needs, and whether an agent is the right tool at all.