Security

Effective date: October 12, 2026

Ipsion agents work with your messages, files and connected accounts, so protecting them is central to how the Ipsion AI agent system is built. This page describes how we protect your data today, what we ask of you, and how to report a security issue. For what we collect and how long we keep it, see our Privacy Policy.

How the system is built

• A dedicated server for each account. Each customer account runs on its own virtual machine in Microsoft Azure. Your conversations, files, agent memory and agent browser sessions are stored on that server, not in a shared pool with other customers.
• Separate sign-in for each customer. Each customer organization has its own sign-in and account-record project on Google Firebase. Account records are read and written by the server side of the Service, not directly by the web console.
• Model keys kept off customer servers. Most AI model and tool keys are held on a separate Ipsion relay service rather than on customer servers. Customer servers use a scoped relay token that we can revoke. The relay records request metadata (time, service, status and duration) for operations and abuse prevention. It does not record the content of your prompts or responses.

How your data is protected

• Encryption in transit. Connections between your browser or apps and your server use HTTPS (TLS).
• Encryption at rest. Server disks and our sign-in and account databases are encrypted at rest by our cloud providers.
• Limited exposure. Each customer server exposes only its web endpoint to the internet (HTTPS, with plain HTTP used only to redirect and renew certificates). Internal services listen only inside the server, and administrative access is restricted at the network level.
• Restricted operator access. Administrative access to customer servers uses key-based authentication from restricted network locations, and is limited to authorized Ipsion personnel and our automated operations tools. We access customer servers to provision, maintain, support and secure the Service.
• Restricted files. Credentials and conversation records on each server are stored with file permissions that limit access to the service account that runs your agents.
• Encrypted secret storage. Each server includes an encrypted store for secrets that users provide to their agents.
• Minimal data in our apps. The Ipsion mobile and desktop apps contain no advertising or crash-reporting software. The usage records they make (clicks, navigation and screen recordings of the interface) hide typed text and chat content before anything leaves your device.
• Encrypted operations backups. Backups of Ipsion's own operations systems are encrypted.

An evolving program

The Service is in early access, and our security program is developing with it. We review our systems regularly and prioritize improvements. These include stronger separation between agents and server administration, automated data deletion and export, off-server backups for customer servers, and shorter log retention. We have not yet completed an independent security audit or certification such as SOC 2. If your organization needs a security questionnaire or specific commitments, contact us before you store sensitive data.

What we ask of you

Security is shared between Ipsion and you:

• Protect your sign-in. Use a strong, unique password. Do not share your account, and do not forward the one-time sign-in links we email you.
• Give agents only what they need. Connect only the accounts your agents need, and prefer "Connect" (OAuth) sign-in over giving us a password when both are offered. Remove access you no longer use.
• Treat outside content with care. Agents read web pages, emails and documents, and that content can try to trick an AI into doing something you did not intend. Review consequential actions, such as payments, public posts and messages to many people, before your agents take them.
• Keep your own copies of anything you cannot afford to lose. See Section 13 of our Terms of Service.
• Tell us quickly if you notice anything unexpected in your account or your agents' behavior.

Reporting a security issue

If you believe you have found a security vulnerability in the Service, email support@ipsion.ai with the subject "Security", and include enough detail for us to reproduce it. We will acknowledge your report and keep you informed as we investigate.

Please act in good faith:

• give us a reasonable time to fix the issue before disclosing it publicly;
• do not access, change or delete data that is not yours, and stop and tell us if you encounter any;
• do not degrade the Service for others, and do not use social engineering, phishing or physical attacks; and
• test only against accounts you own or have permission to use.

We will not pursue legal action against researchers who follow these guidelines.

Incidents

If we become aware of a security incident that affects your personal information, we will notify you, and the authorities where required, as required by applicable law.