Security & Compliance
Your data, our posture
AgentGrade processes agent descriptions, trajectories, and scoring criteria. This page states, plainly, what we handle and what we do not claim.
What we handle
We process AI-agent descriptions, trajectories (steps + final output), and scoring criteria you submit for evaluation. These may contain business-confidential information but are not typically special-category personal data.
Data handling commitments
- Submissions run the evaluation pipeline and are retained only as long as needed for your audit log (Pro) or until you delete the run.
- We apply access controls consistent with GDPR Art. 32 (security of processing).
- BYOK keys are stored server-side only and never exposed to the browser.
Our compliance posture (honesty rule)
- AgentGrade is an evaluation tool, not a certification service. It provides quality scores and regression flags but does not certify production readiness.
- We do not guarantee accuracy, do not claim "100% accurate evaluation", and do not state you will "never miss a regression". Evaluation depends on the quality of the trajectory data you provide.
- For binding deployment decisions, consult qualified ML engineers and QA professionals.
Subprocessors & payments
refs: GDPR Art. 32 · OWASP Top 10