Information Security Policy

1. Purpose and scope

This policy sets the rules Agentropic follows to protect customer information. It applies to every person working for Agentropic, employee or contractor, and to every device and account used for customer work.

2. Where customer work happens

• Our default is to build and run inside the customer's own environment, on the customer's cloud, network and identity system.
• Customer data stays in the customer's environment. It is not copied to Agentropic devices, personal storage or Agentropic cloud accounts unless the customer has approved it in writing.
• Where the customer provides managed devices or a remote workstation, customer work is done only on those.

3. Access and identity

• Each person has their own named account. Credentials are never shared.
• Access is requested only for the systems the engagement needs, and at the lowest level that lets the work be done.
• Customer single sign-on and VPN are used wherever the customer provides them.
• Two-factor authentication is on for all Agentropic email, code hosting and cloud accounts.
• Passwords and secrets are held in a password manager or the customer's secret store. They are never written into code, documents, email or chat.
• We accept logging and audit of all our sessions by the customer.

4. Devices

• Any Agentropic device used for work has full-disk encryption, an automatic screen lock, a supported operating system with current security updates, and is used by one person only.
• Lost or stolen devices are reported to the owner of this policy the same day, and to affected customers within 24 hours.

5. Customer data

• Customer data is used only for the purpose of the engagement.
• Personal data is accessed only where the customer has approved it, and only the minimum needed.
• Customer data is not sent to any third-party service, including AI model providers, without the customer's written approval.
• At the end of an engagement, any customer data or credentials held by Agentropic are returned or deleted, and we confirm this in writing.

6. Software we build

• Code is kept in version control with a full change history.
• Secrets are kept out of source code.
• Dependencies are scanned for known vulnerabilities before release, using the customer's scanning tools where provided.
• We support the customer's security testing before go-live and fix findings by an agreed date.

7. Joiners, leavers and subcontractors

• The customer is told in writing before any new person joins their engagement, and on the same day when a person leaves it.
• On exit, we ask the customer to revoke access immediately, and we remove the person's Agentropic access the same day.
• No subcontractor works on a customer engagement without the customer's written approval, and every subcontractor is bound by this policy.
• Everyone working for Agentropic is bound by a written confidentiality obligation.

8. Security incidents

• An incident is any suspected loss, exposure or unauthorised access involving customer information or access.
• We tell the affected customer within 24 hours of becoming aware, with what we know, and keep them updated until it is closed.
• Each incident ends with a written note of the cause and the fix.

9. Ownership and contact

Agentropic Information Security owns this policy, approves any exception to it, and is the contact for any security question: [email protected].

Agentropic is operated by Kindrnest Essentials Pvt Ltd.