Security & GDPR

This page summarizes the data-side guarantees. For the agent's runtime security architecture (policy engine, quarantine, vault), see Security architecture.

Tenant isolation

Each tenant's knowledge base, connectors, memory and conversations are isolated from others. One tenant can never reach another tenant's data — see Multi-tenant & RBAC.

Encryption & vault

Credentials for connected systems (API keys, OAuth tokens, DB passwords) are stored encrypted with Fernet, never sent to the LLM, and masked in logs. You can delete secrets from the panel at any time.

We don't train on your data

SemAgent does not use your tenant data to train models. Your data is processed to serve you; it isn't used for any other purpose.

Consent-based memory & GDPR panel

• Memory features don't run without consent; each layer can be toggled independently.
• From the GDPR panel you see everything the agent has learned and delete it in one click (see Memory).

Sub-processors & DPA

For the list of sub-processors, the data processing agreement (DPA) and the full security statement, see the Trust Center and Legal pages.