Home / Docs / Security, privacy and data
Security and data in AnroAgents
Where data lives, who can see it, and what is done with it.
AnroAgents runs on AWS in the European Union, in the Ireland region, and the operating company is established in the EU. Conversations, agent configuration and uploaded documents stay within that infrastructure.
What is stored
AnroAgents stores your agent configuration, the documents you upload to the knowledge base, and the conversations your agents have — including whatever the visitor chose to share, such as a name, an email or a company.
Documents you upload to an AnroAgents knowledge base are stored, indexed for search, and used to ground your own agent's answers. They are never shared with other customers and never used to train a model.
Conversation transcripts in AnroAgents are visible to you and to the managers you invited into your workspace. Managers see conversations and agents; they do not see billing.
Access and authentication
Sign-in to AnroAgents runs on AWS Cognito at auth.anroagents.com, with email and password or Google sign-in. Passwords are never stored by the platform itself.
The API key in the AnroAgents widget snippet is public by design — it sits in your page source and identifies the agent to the widget. It cannot read conversations, change the agent or touch the account, and it can be regenerated from the dashboard if you want to invalidate it.
A personal access token in AnroAgents is a secret and is a different thing entirely: it can manage agents through the API. Store it as you would any credential, and revoke it from the dashboard if it leaks.
GDPR and the visitor's data
Under GDPR, an AnroAgents customer is the data controller for their visitors' data, and AnroAgents is the processor acting on their instructions. What is collected is what your agent is configured to collect.
Sending marketing or follow-up email to a visitor requires their consent, and collecting it is the customer's responsibility. AnroAgents provides the mechanism — an opt-in checkbox on the pre-chat form, and an unsubscribe link in every follow-up — but the lawful basis is yours.
Handing a visitor to another business through the AnroAgents lead network always requires the visitor's explicit agreement in the chat, and the recipient is named to them before they agree. That consent is recorded with the referral.
A visitor's data can be deleted on request. Conversations are deletable from the dashboard, and a request covering a person across the account can be made to support.
Payments
Card details are never handled by AnroAgents itself; card payments run through the payment provider, and cryptocurrency payments through a separate crypto payment provider. The platform stores the outcome of a payment, not the instrument behind it.
Availability
AnroAgents runs on serverless AWS infrastructure that scales with traffic rather than on fixed servers, so a spike of visitors on your site does not take the widget down. If the platform is ever unreachable, the widget fails quietly: the bubble does not appear and your site is otherwise unaffected.