Your clients trust you with their work. Here’s how Agencly keeps that data handled properly: the practices that matter for agency work.
Infrastructure
Compute runs on AWS EC2, the database lives on AWS RDS, and files are stored on Cloudflare R2: isolated to your workspace and the clients you invite.
Transactional email is sent through AWS SES. No data is shared across workspaces; each client only sees what you choose to share through their portal.
Encryption
All traffic is encrypted in transit with TLS 1.2 or higher. HTTP requests are automatically redirected to HTTPS.
Data is encrypted at rest using AES-256 on managed infrastructure, so client work isn't sitting in plain text.
Database connections use TLS. File storage (Cloudflare R2) encrypts objects at rest by default.
Authentication & access control
Invite your team and clients with roles: Owner, Admin, Member, Client, Guest: so each person sees only what they should.
Client portals are role-based: every client gets one place to see their own projects, files, invoices, and messages, and nothing belonging to your other clients.
Workspace-level isolation ensures no cross-tenant data leakage. Each workspace is a hard boundary.
Data protection & backups
Automated daily backups of your database with 14-day retention. Backups are encrypted and stored in a separate AWS region.
Point-in-time recovery available for the last 7 days: if something goes wrong, we can restore to any hour.
File storage (Cloudflare R2) has built-in redundancy across multiple availability zones.
Audit & visibility
Every meaningful action is logged. See who changed what, and when: useful when a client asks "who moved this?".
Your workspace is backed up automatically, so a mistake or an outage doesn't cost you client work.
Compliance
GDPR: We support data export and deletion requests. Contact us and we'll handle it within 30 days.
We follow security best practices: encrypted data, role-based access, audit logging, automated backups, and responsible disclosure.
We'd rather be honest than print a badge we haven't earned. Ask us about the compliance roadmap for SOC 2 Type II.
Data retention
Your data stays in your workspace as long as your account is active. Cancel anytime: we retain your data for 90 days, then permanently delete it from production databases and file storage.
Client portal data is tied to your workspace. When you remove a client, their portal access is revoked immediately.
Backups are retained for 14 days. After that, they are permanently deleted from our systems.
Responsible disclosure
If you find a vulnerability, email contact@agencly.app. We read every report and will work with you on a fix and coordinated disclosure.
Please don't test against other people's workspaces, and give us a reasonable window to respond before any public disclosure.
MCP & API key security
The Model Context Protocol (MCP) lets you connect AI agents (Claude, ChatGPT, Cursor) to your workspace through API keys you generate in Settings.
Every key is scoped to specific modules (for example, Projects, Invoices, Contacts) and can be set to read-only or read-and-write. An agent only ever sees what its key permits: workspace isolation still applies.
Keys are encrypted at rest, can be revoked instantly, and every call an agent makes is recorded in an audit log so you can see what was accessed or changed.
Best practice: scope each key to the minimum modules the agent needs, prefer read-only where possible, and rotate or revoke keys you no longer use. Never paste a key into a tool or prompt you don't trust.