Where your data lives, who can touch it, how we keep it safe.

Your data stays in the EU

The platform runs on EU-region cloud infrastructure end-to-end. We do not replicate customer data outside the EU, and we never use US-only sub-processors for core data flows.

Every third-party that touches your data, listed.

If we add a new sub-processor we update this page first and notify customers via email. The list above is canonical — bookmark it for your audit pack.

Audit-ready evidence on every issued cert.

Every certificate gets a unique AF-Lx-YYYY-NNNNNN identifier and an optional public verify URL at agenticfluxus.com/verify/[id]. A regulator, an auditor, or a customer can confirm authenticity in one click. We never charge to verify.

• Issued only after the learner completes every module of the relevant course.
• Stored in the EU; tamper-evident; revocable if a legitimate concern arises.
• Public verify is opt-in. The cert PDF works for private-share scenarios too.

Every byte at rest, every byte in flight.

TLS 1.2+ on every public endpoint. AES-256 at rest on Supabase Postgres + storage. Customer access is gated by Supabase Auth; row-level security policies live on every table that holds tenant data.

Where we are. Where we're going.

If something goes wrong, you'll know within 72 hours.

We commit to notifying impacted customers of any confirmed personal-data breach within 72 hours of discovery, in line with GDPR Article 33. Notifications go to the org admin email of record and include scope, root cause, mitigation, and your rights.

• Detection — internal alerting on auth, billing, and DB error rates 24/7.
• Containment — service-level isolation within 1 hour of confirmed incident.
• Notification — admin emails within 72 hours, regulator notification on our side.
• Postmortem — public, published within 14 days of resolution.

Found something? Tell us.

We welcome reports from independent researchers. We will not pursue legal action against good-faith disclosure that follows the rules below.

• Email security@agenticfluxus.com with reproduction steps. PGP key on /.well-known/security.txt.
• Don't access data you weren't authorised to see. Don't run automated scans against production at scale.
• Give us 90 days to fix before public disclosure. We'll keep you informed in writing throughout.
• Rewards are at our discretion based on severity. We acknowledge every researcher who follows the rules.

What you need for your audit pack.