Security & Responsible Operations
AGRO-AI's security approach is designed around protecting customer boundaries, credentials, operational evidence and the systems that support agricultural decisions.
1. Identity and access
Access to customer and production systems should be authenticated and authorized using role, organization, project or service-account context. Privileged access should be limited to legitimate operational need and reviewed proportionate to risk.
2. Tenant isolation
Customer boundaries are intended to be enforced by application and infrastructure authorization before data reaches retrieval or reasoning layers. Model output is never treated as proof that a user was authorized to access the underlying data.
3. Credential management
Passwords, API keys, tokens, signing keys and connector secrets should be stored and processed through appropriate server-side or secret-management controls. Credentials should not be exposed in frontend code, logs, analytics payloads or model context.
4. Encryption
AGRO-AI uses encryption and secure transport controls appropriate to the systems and providers in use. Public statements about encryption scope are kept aligned to verified production configuration rather than assuming every datastore, backup or integration behaves identically.
5. Logging and auditability
Security, authentication, API, configuration and workflow events may be logged to support reliability, metering, investigations and customer assurance. Logs are access-controlled and should avoid unnecessary sensitive content.
6. Secure development and change management
Security-sensitive changes should be reviewed and tested proportionate to their risk. Production changes should be traceable to source changes and deployment evidence where supported. New connectors, model providers and data flows should receive security and governance review before handling sensitive production data.
7. Vulnerability and dependency management
AGRO-AI seeks to identify and remediate security vulnerabilities in its code, infrastructure and dependencies based on severity, exploitability and customer impact. High-risk findings receive priority handling.
8. Incident response
Suspected incidents are triaged, contained, investigated and documented. Confirmed events involving covered customer or personal data are communicated in accordance with applicable law and contractual requirements. Unsuccessful probes and routine security events are distinguished from confirmed breaches.
9. Availability, backup and recovery
Critical services should have backup, recovery and operational procedures appropriate to their role. Recovery objectives and customer commitments are stated contractually only where the underlying architecture and operating process support them.
10. Service providers
Infrastructure and software providers with access to covered data should be selected based on business need and appropriate security, privacy and contractual considerations. Material provider changes may trigger trust-document review.
11. Customer responsibilities
Customers should protect credentials, configure access appropriately, promptly revoke unused access, validate high-consequence recommendations and notify AGRO-AI of suspected compromise or vulnerabilities affecting the service.
12. Assurance and certifications
AGRO-AI does not claim independent certifications or audit results unless they have actually been obtained and the claim accurately reflects scope and validity. Security questionnaires, contractual security terms and current assurance materials may be provided to qualified enterprise customers where appropriate.
13. Reporting security concerns
Security concerns may be sent to contact@agroai-pilot.com with “Security” in the subject line.
Back to Trust Center