Security

November 18, 2025

Our Security Commitment

At Agora Sigma, security is not an afterthought—it’s fundamental to everything we do. We employ enterprise-grade security measures to protect your data and ensure the integrity of our services.

1. Infrastructure Security

1.1 Cloud Architecture

Our infrastructure is built on industry-leading cloud platforms with:

Geographic Redundancy: Multi-region deployment for high availability
Network Isolation: Virtual private clouds (VPCs) with strict network segmentation
DDoS Protection: Advanced threat detection and mitigation
Load Balancing: Distributed traffic management for resilience

1.2 Server Hardening

All servers undergo rigorous hardening procedures:

Minimal software installations (principle of least functionality)
Regular security patching and updates
Disabled unnecessary services and ports
Intrusion detection and prevention systems (IDS/IPS)

2. Data Protection

2.1 Encryption

We protect your data at every stage:

In Transit: TLS 1.3 encryption for all data transmission
At Rest: AES-256 encryption for stored data
Backups: Encrypted backup storage with secure key management
End-to-End: Optional E2E encryption for sensitive workflows

2.2 Data Isolation

Each client’s data is logically isolated:

Dedicated database schemas per client
Strict access controls and permissions
No data commingling between clients
Secure data disposal when no longer needed

2.3 Backup and Recovery

Comprehensive backup strategy ensures data availability:

Automated Backups: Daily incremental, weekly full backups
Geographic Distribution: Backups stored in multiple regions
Retention Policy: Configurable retention periods
Disaster Recovery: Tested recovery procedures with defined RTOs and RPOs

3. Access Control

3.1 Authentication

Multi-layered authentication mechanisms:

Strong Password Requirements: Enforced complexity and expiration policies
Multi-Factor Authentication (MFA): Required for all privileged access
Single Sign-On (SSO): Support for enterprise identity providers
Session Management: Secure token handling with automatic expiration

3.2 Authorization

Granular permission controls:

Role-Based Access Control (RBAC): Defined roles with specific permissions
Principle of Least Privilege: Minimal necessary access rights
Regular Access Reviews: Periodic audits of user permissions
Privileged Access Management: Enhanced controls for administrative accounts

3.3 API Security

Secure API design and implementation:

API key authentication with rotation capabilities
Rate limiting and throttling
Input validation and sanitization
Comprehensive API logging and monitoring

4. Application Security

4.1 Secure Development

Security-first development practices:

Security by Design: Security considerations from project inception
Code Reviews: Peer review of all code changes
Static Analysis: Automated code scanning for vulnerabilities
Dependency Management: Regular updates of third-party libraries

4.2 Testing and Quality Assurance

Rigorous security testing:

Penetration Testing: Annual third-party security assessments
Vulnerability Scanning: Continuous automated scanning
Security Regression Testing: Verification after changes
Bug Bounty Program: Rewards for responsible disclosure

4.3 Common Vulnerability Protection

Protection against OWASP Top 10 and beyond:

SQL Injection prevention through parameterized queries
Cross-Site Scripting (XSS) mitigation with output encoding
Cross-Site Request Forgery (CSRF) protection
Security headers implementation (CSP, HSTS, etc.)

5. Monitoring and Incident Response

5.1 Security Monitoring

24/7 security operations:

Real-Time Monitoring: Continuous surveillance of systems and networks
Log Aggregation: Centralized logging with SIEM integration
Anomaly Detection: AI-powered threat identification
Alerting: Automated notifications for security events

5.2 Incident Response

Structured incident management:

Incident Response Team: Dedicated security professionals
Response Plan: Documented procedures for various scenarios
Communication Protocol: Clear escalation and notification processes
Post-Incident Analysis: Root cause analysis and improvement

5.3 Threat Intelligence

Proactive security measures:

Monitoring of emerging threats and vulnerabilities
Integration with threat intelligence feeds
Security advisories and patch management
Participation in security communities

6. Compliance and Certifications

6.1 Regulatory Compliance

We maintain compliance with relevant standards:

GDPR: European data protection requirements
SOC 2 Type II: Security, availability, and confidentiality controls
ISO 27001: Information security management system
HIPAA: Healthcare data protection (for applicable services)

6.2 Regular Audits

Independent verification of our security posture:

Annual third-party security audits
Compliance assessments and gap analysis
Continuous monitoring and reporting
Remediation tracking and validation

7. Employee Security

7.1 Security Training

Comprehensive security awareness program:

Onboarding Training: Security fundamentals for all new employees
Regular Updates: Quarterly security awareness sessions
Phishing Simulations: Practical exercises to maintain vigilance
Specialized Training: Advanced security training for technical staff

7.2 Background Checks

Thorough vetting process:

Background checks for all employees
Enhanced screening for privileged access roles
Non-disclosure agreements (NDAs)
Security clearances where required

8. Physical Security

8.1 Data Center Security

Our cloud providers maintain:

24/7 on-site security personnel
Biometric access controls
Video surveillance systems
Environmental controls and monitoring

8.2 Office Security

Our facilities implement:

Controlled access with badge systems
Visitor management and escort policies
Secure areas for sensitive operations
Clean desk and clear screen policies

9. Vendor Security

9.1 Third-Party Risk Management

Rigorous vendor assessment:

Security questionnaires and due diligence
Contractual security requirements
Regular vendor security reviews
Incident notification obligations

9.2 Supply Chain Security

Protecting against supply chain attacks:

Verification of software integrity
Secure software development lifecycle
Code signing and verification
Dependency vulnerability monitoring

10. Business Continuity

10.1 High Availability

Designed for continuous operation:

Redundant Systems: No single points of failure
Automatic Failover: Seamless transition during outages
Load Distribution: Traffic routing across multiple instances
Health Monitoring: Proactive detection of issues

10.2 Disaster Recovery

Prepared for worst-case scenarios:

Recovery Time Objective (RTO): Target restoration time
Recovery Point Objective (RPO): Maximum acceptable data loss
Regular Testing: Quarterly disaster recovery drills
Documentation: Detailed runbooks and procedures

11. Reporting Security Issues

We welcome and encourage responsible disclosure of security vulnerabilities.

How to Report

If you discover a security issue:

Do Not: Exploit the vulnerability or access unauthorized data
Email: security@agorasigma.com with details
Encrypt: Use our PGP key for sensitive information
Provide: Steps to reproduce, impact assessment, and proof of concept

What to Expect

Acknowledgment: Within 24 hours of report
Updates: Regular communication on resolution progress
Recognition: Public acknowledgment (with your permission)
Rewards: Potential bug bounty rewards for significant findings

12. Security Contact

For security-related inquiries:

Email: security@agorasigma.com PGP Key: [Link to PGP Key] Security Portal: security.agorasigma.com

Security is a shared responsibility. Thank you for helping us keep our platform secure.