Data, privacy and security

Where your data lives and what we store

What happened

You signed in, connected Microsoft, or built a compliance-readiness record, and you want to know where that data is held and what is retained.

Why it matters

You are likely documenting agents that touch real business systems, so you need to be clear on what AgentProof keeps before you share a documentation pack internally. AgentProof stores your account, your workspace, your connection records, your manually entered agent details, and your generated documentation packs in a managed database hosted in the European Union (EU data residency). It does not read or store the contents your agents process at runtime; it works from what you connect or enter and the readiness answers you provide.

What to do next

1. Sign in and open your workspace to see exactly what is stored: your environments and agents (if connected), your manual agents, and your saved reports.
2. To remove a manually entered agent, delete it in the workspace; manual data is scoped per workspace, so check you are in the right workspace first.
3. Use the data controls below to export your account data (read-only), disconnect Microsoft, or delete your own data (for workspace owners this also removes the workspace's environments, connections, reports, and captured assessment data); a full workspace-wide deletion is available self-service in workspace settings (owner-only, typed confirmation), or review the retention policy.

What information to include

1. Your account email.
2. Your workspace name.
3. Whether you need an export, a deletion, or a retention change.
4. The specific report or agent, if your request relates to one.

When to contact support

For a data export, an account-wide deletion request, or questions about EU data residency or processing, email [email protected] and include your account email and workspace name.

Exporting, deleting, and retaining your data

What happened

You want to take your data with you, remove it, or understand how long AgentProof keeps it.

Why it matters

A read-only export is available to you now, you can disconnect Microsoft yourself, and you can delete your own scorecard data (your agents, their versions, and saved scorecards) from the delete-data control. A full workspace-wide deletion (environments, connections, reports, radar items, and captured assessment data together) is available to the workspace owner as a self-service control in workspace settings; it requires a typed confirmation phrase and a record of the deletion is kept. Reports are kept immutable as a fixed record, retained for audit and security, so you can compare a re-score against an earlier run. AgentProof does not sell your data.

What to do next

1. Use the Export data control to download a read-only copy of your account data (linked from this section and from /account/export).
2. Disconnect Microsoft from your workspace data controls at any time; this removes the stored connection.
3. Use the Delete data control to remove your scorecard data yourself (your agents, their versions, and saved scorecards) from /account/delete-data.
4. For a full workspace-wide deletion, use the Delete workspace data control in your workspace settings (owner-only, typed confirmation). If you cannot run it yourself, email [email protected] and our team will run and confirm the deletion for you.
5. Review the retention policy to understand what is kept and for how long (/account/retention).
6. Read the public Security and Privacy pages for the overall posture before sharing a report (/security and /privacy).

What information to include

1. Your account email and workspace name.
2. Whether you need an export, a deletion, or a retention change.
3. Which control you already tried (Export, Delete, or Retention).
4. The specific report or agent, if your request relates to one.

When to contact support

If a data export, deletion, or retention question is not answered by the controls above, email [email protected] with your account email and workspace name.

What AgentProof does and does not do with your data

What happened

You want to understand the limits of what AgentProof is, so you can describe it accurately to stakeholders.

Why it matters

AgentProof is a deterministic AI-agent compliance-readiness and documentation tool. It reads what you connect or enter, scores it, and produces a compliance-readiness record. It does not watch your agents at runtime, and it makes no certification, audit, or compliance attestation claim. Being clear about this protects you from over-representing a result.

What to do next

1. Present a result as an AgentProof compliance-readiness record, not as a certified or audited outcome.
2. Remember the connector uses Microsoft standard consent: you sign in with your own Microsoft account and Microsoft controls what AgentProof is permitted to see; it does not change your tenant.
3. If you no longer want AgentProof connected, revoke its access from your Microsoft account app permissions; AgentProof cannot retain access Microsoft has withdrawn.

What information to include

1. Your account email and workspace name.
2. Whether you want written confirmation of how AgentProof handles your data.
3. The specific report or its history, if you want something removed.
4. Whether you have already revoked AgentProof's access in your Microsoft account.

When to contact support

If you need written confirmation of how AgentProof handles your data, or a report or its history removed, email [email protected] with the workspace and report details. Your data is stored in the EU.