Frameworks and status
GDPR
We act as a data processor. We sign a DPA under Art. 28, publish our subprocessors and notify you of every change. Configurable retention, full export and contact erasure from the dashboard.
AvailablePCI DSS
Payments are processed by PayComet, a PCI DSS Level 1 provider. Card data never touches 008.
In productionEU AI Act
Transparent by design: end users know they are talking to an AI and can reach a person.
In production
SSL Labs A+
The platform earns the top grade for its TLS configuration on Qualys SSL Labs. See the live report
In production
MDN HTTP Observatory A+
The platform, the support console and this website earn the top grade for HTTP security headers, with an enforced Content Security Policy. See the live report
In productionSOC 2 Type II
On our roadmap. If your review requires it, we will share the status and timelines.
On the roadmapCSA STAR Level 1
We have prepared our self-assessment with the Cloud Controls Matrix CAIQ v4.1 questionnaire. It is pending publication in the Cloud Security Alliance STAR registry.
Pending publicationHIPAA
A HIPAA mode with a BAA for Enterprise plans, together with strict BYOK.
On the roadmapAI and your data
What sets us apart from a generic SaaS: your conversations go through AI models, and you have the right to know how.
- We don't train models on your data
- 008 does not use your customers' conversations, contacts or knowledge base to train models, ours or anyone else's.
- Zero data retention on models
- We access models through OpenRouter with Zero Data Retention: only providers that neither store your data nor train on it are used, and we check it automatically every day.
- Prompt injection protection
- A Security Gateway inspects every inbound message and blocks attempts to manipulate the agent before they reach the model.
- No internal context leaks
- An output sanitizer checks every reply before it is sent: agents never reveal their prompt, their tools or other contacts' data.
- You decide when AI answers
- Handoff to human agents in your contact center (Genesys, Five9) and control over when the AI replies and when a person does.
- Transparency with end users
- Anyone talking to a 008 agent knows it is an AI, as the EU AI Act requires.
Security controls
We only list controls that are in production today.
Application security
- Prompt injection detection on every inbound message
- Agent replies sanitized before they are sent
- Content Security Policy with per-request nonces and security headers
- Tool requests blocked from reaching internal networks (anti-SSRF)
- Signature verification on channel webhooks
- Card number detection in messages
Data protection
- Encryption in transit with TLS 1.2/1.3 (A+ on SSL Labs)
- Integration credentials encrypted with AES-256-GCM
- Per-account data separation in the database with Row-Level Security, with isolation tests on every change
- Encrypted, immutable daily backups in the EU, with an automatic restore test every day
- Configurable conversation retention per account
Account access
- Two-factor authentication (TOTP) required for every user
- Lockout after failed login attempts
- Owner, admin and member roles
- Append-only activity log, kept for 13 months and exportable
- Every support access to your account is logged and visible to you
Operations
- Operational alerting and heartbeats for scheduled jobs
- Versioned deployments with rollback
- No change reaches production without passing tests and dependency and image scans
- Named server access, key-only and without root
Payments
- Card data handled by PayComet (PCI DSS Level 1)
Documents
Privacy and data rights
- Data processor
- You are the controller of your customers' data; we process it only on your instructions, as set out in the DPA.
- Retention and deletion
- You choose how long conversations are kept: from 30 days to 10 years, or indefinitely. When the contract ends, we delete your data.
- Export
- The account owner can download all of the account's data from the dashboard at any time.
- Data subject rights
- Export or erase a contact's data from their profile to handle access and erasure requests.
Subprocessors
Providers that process customer data to deliver the service.
| Provider | Purpose | Data | Country |
|---|---|---|---|
 OVHcloud | Platform hosting | All |  France (EU) |
| Cloudflare | DNS and encrypted backups (R2) | Encrypted backups; Cloudflare doesn't hold the key | EU |
 OpenRouter | AI model routing with zero data retention (ZDR) | Conversation content |  USA and EU |
| Model providers | Response generation (via OpenRouter, zero-retention endpoints only) | Conversation content | Depends on the model |
 Meta | WhatsApp, Messenger and Instagram | Messages and contact profile | USA and EU |
 Telegram | Messaging channel, only if you enable it | Messages and contact profile |  United Arab Emirates |
 Resend | Email delivery | Email address and content | USA |
 Lago | Billing, self-hosted on our infrastructure | Account billing data | France (EU) |
 PayComet | Payments | Payment data (008 never sees it) |  Spain |
| GitHub | Source code and daily backup restore test | Database copy during the test, deleted afterwards | USA |
Integrations you enable (CRM, Genesys, Five9, n8n, MCP, HTTP tools) are not 008 subprocessors: your contract with them is your own.
Notify me of subprocessor changesResponsible disclosure
If you find a vulnerability, email security@008agent.ai with steps to reproduce it. We acknowledge every report, keep you updated and take no action against good-faith research.
Frequently asked questions
Do you use our data to train models?
No. 008 does not train models on your data, and our OpenRouter account only routes to zero-data-retention providers: they neither store your data nor train on it. We check this automatically every day.
Where is the data hosted?
The platform and database run on OVHcloud in France (EU), and encrypted backups are stored on Cloudflare R2, also in the EU. Traffic to AI models and channels such as WhatsApp may leave the EU; those transfers and their standard contractual clauses are set out in the DPA.
How long do you keep conversations, and how are they deleted?
You choose in the dashboard: from 30 days to 10 years, or indefinitely. Deletion is automatic and logged. Encrypted backups expire after 35, 90 or 400 days depending on their type. When the contract ends we delete your data, and you can download a full export first.
Can I bring my own OpenAI, Anthropic or Gemini key?
BYOK is on our roadmap. When it ships, we will publish here which calls go through your key and which don't, and who is responsible for each part.
Do you have SOC 2? Do you sign a BAA for HIPAA?
Not yet. SOC 2 Type II and a HIPAA mode with a BAA are on our roadmap. If your review requires them, email us and we will share the status and timelines.
How do you isolate each customer's data?
Each account's data is separated in the database with Row-Level Security, on top of the application's access controls.
How do I report a vulnerability?
Email security@008agent.ai. Details are in the responsible disclosure section and in our security.txt.
How will I hear about subprocessor changes?
Subscribe to change notifications on this page and we will email you before adding a new subprocessor.
Agent 008