auto-AGENTS™ is built and operated by Commerce.AI. This page summarizes our certifications, the controls in our security program, how customer data is handled, and how to obtain our reports, policies and Data Processing Agreement. For live status and downloadable evidence, visit our Trust Center.
Our compliance status is maintained and monitored in our Trust Center. Certificates, the current SOC 2 report and framework mappings are available there on request.
| Framework | Scope | Status |
|---|---|---|
| SOC 2 | Trust-services criteria for security, availability & confidentiality. SOC 2 report (2025) available under NDA. | Compliant |
| ISO/IEC 27001 | Information Security Management System (ISMS) certification. | Compliant |
| HIPAA | Safeguards for Protected Health Information; Business Associate Agreements available. | Compliant |
| PCI DSS | Payment Card Industry Data Security Standard for handling cardholder data. | Compliant |
| GDPR | EU General Data Protection Regulation; DPA and SCCs available. | Compliant |
| EU AI Act | EU regulation on artificial-intelligence systems. | Compliant |
These controls are implemented and continuously monitored as part of our compliance program. Each is evidenced in the Trust Center; the summaries below describe what each domain covers.
How customer conversations are protected across their lifecycle, from ingress to storage and deletion.
All data is transmitted over HTTPS with TLS and encrypted at rest with AES-256 on production databases. Production databases and administrative (SSH) access are isolated from the public internet, and keys are managed under our KMS. Backups are taken regularly and integrity-verified.
Sensitive identifiers, names, account and card numbers, are redacted or masked so reviewers and downstream systems work on minimized transcripts. Card (PAN) data is handled to PCI DSS requirements. Customer conversations are not used to train shared models; retention windows are configurable.
auto-AGENTS™ can run in our managed, monitored cloud, inside your own VPC, or on-premises, with data residency options for regulated workloads. The same security controls apply across deployment models. Specific residency and deployment commitments are confirmed per contract.
Identity, monitoring and record-keeping controls that keep access appropriate and actions attributable.
Access to critical systems is granted by approval, per role or individual need, and revoked promptly on termination.
Security incidents are recorded, investigated and responded to under a defined policy, with reporting paths for staff and customers.
Staff are screened, acknowledge policies, and complete security & privacy training on hire and periodically.
Because auto-AGENTS™ operates AI agents on customer conversations, our program addresses AI-specific risk. Our AI systems are governed in line with the EU AI Act, with transparency, human oversight and risk-management practices built into how agents are deployed.
Our AI systems are governed in line with the EU AI Act, including transparency and risk-management practices for automated interactions.
Agents operate with configurable guardrails and escalation to a person; sensitive actions can require human approval.
Customer conversations are not used to train shared models. Sensitive data is minimized before storage and retention is configurable.
We maintain a register of legal, statutory and regulatory requirements relevant to information security and privacy, and assign asset ownership.
How we act as a processor of customer data, and the documents available to support your own compliance.
A DPA, with EU Standard Contractual Clauses where applicable, is available to customers to govern processing of personal data.
We support customers in fulfilling GDPR / privacy rights, including access, correction and deletion of personal data.
We maintain a current list of subprocessors used to deliver the service; it is available on request through the Trust Center / DPA.
Retention windows are configurable per customer, and data is deleted on request or at contract end per the DPA.
Our current privacy practices are published and kept accessible. See the Privacy Policy.
Service terms govern use of auto-AGENTS™. See the Terms of Service.
Our internal policies and audit evidence are catalogued in the Trust Center. A sample is listed below; the full library (40+ policies) and the SOC 2 report are available to prospects and customers on request.
Commerce.AI has operated since 2016 across sectors including healthcare, retail and finance.
BAAs, PHI minimization and encryption support patient intake, scheduling and member-service workflows within HIPAA boundaries.
PCI DSS handling and live PAN masking keep card data out of transcripts during billing, collections and verification.
GDPR compliance, a DPA with SCCs and EU AI Act alignment support European and cross-border deployments.
Commerce.AI is compliant with SOC 2, ISO/IEC 27001, HIPAA, PCI DSS, GDPR and the EU AI Act. Certificates and the SOC 2 report are available through the Trust Center at compliance.commerce.ai.
Data is encrypted in transit over HTTPS/TLS and at rest with AES-256 on production databases. Production databases and SSH access are isolated from the public internet, and keys are managed under our KMS.
No. Customer conversations are not used to train shared models. Sensitive identifiers are redacted or masked before storage, and retention windows are configurable.
Yes. A HIPAA Business Associate Agreement and a GDPR Data Processing Agreement (with Standard Contractual Clauses where applicable) are available to customers.
Request access through the Trust Center at compliance.commerce.ai for the SOC 2 report, certificates, policies and subprocessor list. Send security questionnaires to your account contact and we will respond with documented evidence.
auto-AGENTS™ can be deployed in our managed cloud, your VPC or on-premises, with regional data-residency options for regulated workloads. Specific residency and deployment terms are confirmed per contract.
Request access to evidence for your security review, or send us your questionnaire.