Security

Protecting your business data is core to how Agent7even is built. This page summarizes the security practices behind the platform.

1. Data Encryption

• All traffic to and from the platform is encrypted in transit with HTTPS / TLS.
• Data is encrypted at rest in our database infrastructure.
• Sensitive credentials such as OAuth tokens and API keys are stored encrypted and are never exposed to the browser.

2. Account Security

• Authentication is handled by Clerk, a SOC 2 Type II certified identity provider.
• Sessions are managed with secure, httpOnly cookies.
• Team access is role-based — members only see what their role allows.

3. Data Isolation

Your data lives in a PostgreSQL database (Supabase) protected by row-level security policies. Every query is scoped to your account — your business data, connected account data, and AI outputs are never visible to other Agent7even customers.

4. Third-Party Integrations

• Connections to Google Analytics and social platforms use OAuth — we never see or store your passwords.
• We request the minimum scopes needed (for example, read-only access to your analytics data).
• You can disconnect any integration at any time, which immediately deletes the stored tokens.
• Payments are processed by Stripe; raw card details never touch our servers.

5. Infrastructure

The platform runs on Vercel with automatic security patching, DDoS mitigation, and isolated serverless execution. Database and storage are hosted by Supabase on SOC 2 compliant infrastructure.

6. Data Deletion

You can request deletion of your account and all associated data at any time using our User Data Deletion page. Disconnecting an integration removes its stored credentials immediately, and cancelled accounts are purged after a 30-day grace period.

7. Reporting a Vulnerability

If you believe you have found a security issue in Agent7even, please report it to us right away: