Security and data handling, stated precisely.
Simple Agent documents what is live, what is in preparation, and where customer data is processed. We do not claim that every byte stays in Brazil.
SA-East-1
Postgres region for structured BR production records
USA
LLM generation location through OpenRouter/Gemini
No training
Customer conversations are not used to train model providers
Data residency, without overclaiming
Structured application records for Brazilian production workspaces are stored in Neon Postgres on SA-East-1. LLM generation runs through OpenRouter/Gemini in the United States. Embeddings use OpenRouter with Parasail and the bge-m3 model in the USA. Cohere is used only for reranking. Email, billing, hosting, and error monitoring may process data in the USA or globally. The accurate claim is regional Postgres storage plus documented international processors, not complete data residency in Brazil.
Structured records
Workspace, user, agent, conversation, ticket, and billing references live in Neon Postgres on SA-East-1 for BR production records.
LLM generation
Conversation content may transit OpenRouter for transient Gemini generation and is not used for provider model training.
Embeddings
Document chunks and query text for retrieval indexing may be embedded via OpenRouter with Parasail (bge-m3) in the USA.
Reranking
Document chunks and query text may be sent transiently to Cohere in USA/Canada for reranking.
Operational processors
Vercel, Resend, Stripe, and Sentry can process operational, billing, email, and error data outside Brazil.
Compliance status
We separate active controls from certifications that are still being prepared. A mapped control is not the same as an issued audit report.
| Standard | Status | Notes |
|---|---|---|
| LGPD | Controls active | DPO contact, data-subject request flow, PII scrubbing, retention controls, DPA template, and subprocessor list are documented. |
| GDPR | Controls mapped | DPA and SCC posture are documented for international transfers and customer requests. |
| SOC 2 Type II | Preparing evidence | Controls are mapped and evidence is being organized. No external SOC 2 report has been issued yet. |
| PCI DSS | Stripe-hosted | Cardholder data is handled by Stripe Checkout and Customer Portal. Simple Agent does not store full card numbers or CVC. |
| HIPAA | Not assessed | No HIPAA claim is made on the public product. A BAA is not included in self-serve plans. |
Security controls
Encryption and secrets
- Data at rest is encrypted by the managed storage layer; transport uses TLS on public routes.
- Sensitive action tokens are encrypted before persistence.
- Secrets are environment-managed and must not be committed to version control.
Authentication and tenant isolation
- Passwordless magic-link authentication is live; OAuth can be added without removing magic links.
- Workspace-scoped routes enforce tenant context before reading or writing customer data.
- API keys return the plain token only once at creation.
Application security
- URL ingestion blocks private IPv4/IPv6 ranges and DNS rebinding patterns.
- Webhook routes validate provider signatures for active channels.
- When retrieval context is insufficient, chat routes answer conservatively instead of calling the LLM freely.
Operations
- Security fix waves are tracked with verification.
- Public subprocessors use a single canonical source in code.
- Incident and vulnerability contacts are published on this page.
Privacy controls
No model training on customer conversations
Customer conversations are used for the requested response and product operation, not for training provider models.
PII-aware logging
Sensitive identifiers are scrubbed before observability pipelines wherever the app controls the payload.
Retention and export
Customer data can be exported or removed through legal/privacy flows and retained where required for billing or security.
Subprocessors
This table is rendered from the canonical subprocessor list used by the Trust Center, subprocessor page, and DPA PDF.
| Provider | Role | Data processed | Location | Policy |
|---|---|---|---|---|
| OpenRouter | Chat generation gateway (Gemini) and embedding API gateway/router | Conversation content for transient generation; document chunks and query text for embeddings (transient; data_collection: deny) | USA | Policy |
| Parasail | Text embeddings inference (BGE-M3, pinned via OpenRouter) | Document chunks and query text for embedding (transient) | USA | Policy |
| Vercel | Hosting, edge network, serverless functions | Request logs, IP addresses (edge-level) | Global (edge) | Policy |
| Neon | PostgreSQL database (SA-East-1 for BR clients) | All structured personal data: email, name, conversation records | BR (SA-East-1) | Policy |
| Cohere | Text reranking (rerank-v3.5) | Document chunks and query text sent for reranking (transient) | USA / CA | Policy |
| Resend | Transactional email delivery | Email address, message content | USA | Policy |
| Stripe | Subscription billing, hosted checkout, invoices, and customer portal | Billing data, card tokens (no raw card data reaches Simple Agent) | USA | Policy |
| Sentry | Error monitoring (PII scrubbed before send) | Stack traces, error context (PII recursively scrubbed) | USA | Policy |
Vulnerability disclosure
Send vulnerability reports to security@simple-agent.me with reproduction steps, affected surface, and impact. Scope: simple-agent.me, deployed subdomains, widget embed code, and API routes. Denial-of-service, social engineering, and physical access are out of scope.
security@simple-agent.meIncident response
Personal-data breaches are handled under GDPR Art. 33 and LGPD Art. 48 notification expectations. Affected customers are contacted directly; public status updates are used when the impact is broad.
Need a security review?
Scale customers can request a security questionnaire, architecture walkthrough, and DPA negotiation with the enterprise team.
Contact enterprise