Trust Center
Security you can verify
Everything your legal, security and procurement teams need to evaluate Abundly: the controls on every plan, what Enterprise adds, and the documents behind them.
Security overview
Built for enterprise security
The essentials your security and compliance team will ask about, with the detail behind each one on the Security page.
Data residency
EU only
Databases, files, audit logs, and task queues are stored exclusively in EU data centers on AWS and GCP.
Encryption
AES-256 at rest, TLS 1.2+ in transit
All data is encrypted in storage and on the wire. Secrets are protected with RSA-OAEP and never reach the LLM.
ISO 27001
Certified
Audited against the international information-security management standard, with a European focus that maps cleanly to most procurement reviews.
EU AI Act
Aligned by design
Transparent decision logging, human-in-the-loop approval, and EU-only residency match the obligations relevant to enterprise AI deployments.
GDPR
Compliant by default
EU residency from day one, Data Processing Agreements available, and full data-subject rights respected end to end.
Audit trail
Every agent action logged
Trigger, plan, execution, and outcome are captured immutably for every action. Agent actions are auditable in the activity log in real time.
Go deeper
Three pages for the questions your security, IT and risk teams will ask.
Security
How the platform protects your data, from the infrastructure up to every agent action.
- Layered architecture and guardrails
- Encryption at rest and in transit
- Dedicated EU environment option
Governance
How IT keeps control while many people across the business build agents.
- Teams, roles and access levels
- Sandbox to production, with review
- Key metrics, limits and audit logs
Risk and autonomy
How much autonomy each agent gets, and who decides.
- Risk tiers matched to autonomy
- Humans in the loop where it matters
- A path from idea to production
How teams handle this in practice
Running agents in practice
Controls by plan
Security is not an upsell. These controls are on every plan, and Enterprise adds what large rollouts need.
On every plan
- EU data residency
- Change audit log
- Support access only with admin approval, audited
- Approve or object to subprocessors
- Model governance, including EU-hosted models
Enterprise adds
- Dedicated EU environment with its own IP
- SSO: sign in with your company identity
- Log of who viewed sensitive data
- Signed DPA
- Advance notice before new subprocessors
- Keyless agent access to your Google Cloud
Voice features (calls, transcription and speech) use providers that process data outside the EU. Everything else runs in the EU.
Compare plansDocuments & policies
Publicly available agreements and policies that govern how we handle your data.
Data Processing Agreement
GDPR-compliant DPA covering how we process customer data on your behalf, including sub-processor obligations.
Sub-processors
The current list of third-party processors that may process customer data on our behalf, with their role and region.
Privacy Policy
How we collect, use, and protect personal data across our products, websites, and services.
Cookie Policy
Details on the cookies and similar technologies we use on our websites, and how to control them.
Terms of Service
The contractual terms that govern your use of Abundly products and services.
Available on request
Certificates and questionnaires we share with prospective and existing customers under NDA, along with a signed DPA for Enterprise.
ISO 27001 certificate
Our current ISO/IEC 27001 certification, showing scope, certifying body, and expiration. Provided under NDA.
Security questionnaire (CAIQ / SIG / custom)
Completed responses to standard vendor security assessments, or your own questionnaire. Reach out with the format you need.
Platform status
Live uptime and incident updates at status.abundly.ai.
Report a security concern
Email support@abundly.ai and we will get back to you promptly.
On the horizon
Items we are working towards or evaluating. They are not available to request today.
Penetration test report
Our first independent third-party penetration test is scheduled for H2 2026. We will share findings and remediation status with customers after that cycle completes.
SOC 2 Type II
SOC 2 Type II certification is planned. ISO 27001 remains our primary certification for European procurement; we will share the SOC 2 Type II report with customers once certification is complete.