AGI TECH

Security and privacy

How the AGI Tech client portal handles your data. Updated 11 November 2026.

Where your data is stored

The portal, its PostgreSQL database and its file storage run on DigitalOcean in Singapore, encrypted at rest. Every connection is encrypted: the site is HTTPS only, and the app checks the database server's certificate before it connects. Pages run only the portal's own code (a strict Content-Security-Policy) and can't be shown inside other sites.

Who can see what

  • Your people see only your workspace. This is checked on the server for every page, file and action.
  • AGI Tech admins see every client's workspace. Today that's Brad Zarich.
  • Drafts, our internal notes and call recordings stay with AGI Tech until we share them.

How sign-in works

There are no passwords. Each person signs in with a link or 6-digit code emailed to their own address. A link works once, and expires after 7 days for an invite (14 for a link we send you ourselves) or an hour after you ask for it. A code works for an hour, and stops working after 5 wrong tries. Links, codes and sessions are stored only as one-way hashes. A session belongs to one person and lasts up to 30 days (12 hours for admins). When someone leaves your team, tell us and we turn off their access straight away.

Signing

Only the signatories your company names can sign a proposal, quote or handover, and we email each one a code to confirm it's them. The signed PDF ends with an audit certificate: who signed and how they were verified, when, their IP address and device, the words they agreed to, and a SHA-256 fingerprint of the exact version. A signed document can't be changed.

Files and activity

Files are kept in private storage under random names. Download links expire after 5 minutes, files always download rather than open in the portal, and types that can run code in a browser (such as HTML and SVG) are refused. Your team can see an activity log of every sign-in, answer, upload, download and signature, and of each time AGI Tech, or Claude working for us, opened your data.

Services outside Singapore

  • Anthropic (Claude) writes the “What we heard” summary from your answers and the breakdown of each call, and helps us read your answers when we prepare your proposal.
  • ElevenLabs turns a call recording into a transcript, only when we upload a recording.
  • Resend sends the portal's emails, so it handles what's in them: sign-in links and codes, names, email addresses and comment text.

Keeping and deleting data

We keep your workspace while we work together, and delete it with all its records and files whenever you ask. Database backups expire after 7 days. Please don't put passwords or keys in the portal: answers that look like one are refused, but no check catches everything.

Report a security issue

Email [email protected] with what you found and how to reproduce it.