This policy explains how Imperium Business Intelligence Ltd, trading as Agent Shield (“Agent Shield”, “we”, “us” or “our”), collects, uses, stores and protects data when you use the hosted Agent Shield service: the governance API at app.agentshield.online and the console. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Using this website only? The website has its own Privacy Policy and Cookie Policy. The contract for the service is the Service Terms.
1. Who we are
Imperium Business Intelligence Ltd, trading as Agent Shield. Registered in England and Wales, company number 12077518. Registered office: 29 Cliffe Avenue, Margate, England, CT9 5DU. Contact for data protection matters: ceo@agentshield.online.
We are the controller of the account and usage data described below. Where the payloads your agents submit for evaluation contain personal data about other people, we process that data on your behalf, to provide the service to you.
2. What we collect
Account data
- Company name, given at registration to identify your organisation.
- Contact email, used for account management, service communications and security notices.
- Console users: email address, name, role, the time of the last sign-in and failed sign-in counts. Passwords are stored only as Argon2 hashes; if two-factor authentication is set up, its secret is stored too.
Usage and operational data
- Request times, evaluation counts, response times and errors.
- Agent and sandbox identifiers, configurations and governance mode settings.
- Rate-limit and quota counters, keyed by tenant, agent and client IP address. These are short-lived and kept in our cache, not in the database.
- Application logs kept by our hosting provider.
Evaluation payloads
- Payloads that your agents submit are evaluated as they arrive.
- Each decision is stored in the audit trail with its metadata (decision, risk scores, evaluation tier, processing time) and a minimised copy of the payload: identifiers that look like personal data (such as email addresses, phone numbers, account numbers, IBANs, card numbers and IP addresses) are replaced by pseudonyms made with a key unique to your tenant, and free text longer than 256 characters is dropped. Amounts and short codes are kept, because the governance checks need them.
- A tenant can choose to store payloads in full, or to store none of the payload.
3. Legal basis for processing
- Contract (Article 6(1)(b)): processing account data is necessary to perform our contract with you, including creating your account, delivering the service and billing.
- Legitimate interests (Article 6(1)(f)): processing usage data and evaluation metadata is necessary for delivering the service, security monitoring, improving the platform and preventing fraud. We have assessed that these interests do not override your fundamental rights.
4. How we process data
- Evaluation: each payload is analysed by the governance engine in memory and a decision is returned.
- Language model checks: for actions that reach the language model tier, the high-risk check or the console assistant, the service sends Anthropic a prompt built from the action: its domain and type, a size-capped excerpt of the payload, and relevant context. This excerpt is taken from the payload as submitted, not from the minimised copy. API keys and other tenants’ data are never sent.
- Audit trail: decisions and their metadata are written to an append-only audit trail. Each entry is authenticated with HMAC-SHA256 and chained to the one before, and chain heads are signed with Ed25519, so that a changed or removed entry can be detected.
- We do not use your data to train or fine-tune any language model, we do not sell it, and we do not use it for any purpose other than providing the service to you.
5. How long we keep data
- Stored payloads: kept for your retention period, 90 days unless you set another (from 1 day to 10 years). After that the payload is moved to an archive in the same database, where it can be restored. It is erased only when you ask us to erase it, when your tenant is removed, or if you have chosen erasure instead of archiving as your retention action.
- Decision records: the decision and its metadata stay in the audit trail while your account exists. An erasure removes the payload and keeps a signed record that the erasure happened, so that the audit trail still verifies.
- Account data: kept while your account is active, and for 30 days after it ends so that you can ask for an export.
- Removing a tenant: when an account is closed we revoke the tenant’s API key and then delete the tenant’s rows from every table of the live database that holds them. We keep a record that the removal took place (which tenant, when, how many rows, a signed receipt), but none of the removed content.
- Backups: our database provider keeps a point-in-time recovery history for a limited period. Data removed from the live database stays in that history until the period passes. If we ever restore from it, we apply the recorded erasures and removals again.
- Cache and logs: rate-limit counters and cached decisions expire on their own within a short time. Logs and error reports held by the providers in section 7 are kept for the period their service keeps them.
6. Security
- Encryption in transit: the service accepts only HTTPS (TLS 1.2 or 1.3) and sends HTTP Strict Transport Security; plain HTTP is redirected.
- Encryption at rest: our database provider encrypts the stored data at rest.
- Audit integrity: HMAC-SHA256 chained entries with Ed25519-signed chain heads, as described in section 4.
- API keys: stored only as a SHA-256 hash. The key itself is shown to you when it is issued and is not stored.
- Console accounts: passwords are hashed with Argon2. Two-factor authentication (TOTP) is available, and is required for operator, auditor and administrator roles. Sessions last at most 12 hours.
- Error reports: before an error report leaves the service, request bodies, cookies, query strings, credential headers and local variables are removed, and anything that looks like a credential is masked.
7. Sub-processors
The hosted service uses the following providers. A provider receives only what is listed here.
| Provider | Purpose | What it receives | Location |
|---|
| Railway | Application hosting | Everything the service processes in memory; application logs | Available on request |
| Neon | PostgreSQL database | All stored data: account data, audit trail and stored payloads, archive | United Kingdom (London) |
| Upstash (Redis) | Rate limiting and caching | Counters keyed by tenant, agent and client IP address; short-lived cached decisions and account records | United Kingdom (London) |
| Upstash (QStash) | Delivery of asynchronous evaluation callbacks | The callback request to deliver | EU (Frankfurt) |
| Anthropic | Language model evaluation | The prompt described in section 4 | United States |
| Resend | Transactional email | Recipient address, subject and body of service emails (verification, password reset, invitations, notices, reports, certificates); never evaluation payloads | United States |
| Sentry | Error tracking | Error type and message, stack trace, route and release, scrubbed as described in section 6 | EU (Germany) |
| Axiom | Operational event logging | Per evaluation: action and agent identifiers, tier, decision, risk score, timing and flags; per language model call, its name and timing. Never payload content | United States |
| PostHog | Product usage analytics | Events keyed by tenant identifier: domain, action type, decision, risk score, evaluation tier. Never agent or action identifiers, payload content, email addresses or IP addresses | EU |
Our deployment secrets are held by Doppler, which receives configuration secrets only and no customer data. Webhooks and other destinations that you register receive your own events; they are your providers, not ours.
8. International data transfers
Our database is in the United Kingdom. Anthropic, Resend and Axiom process the data listed above in the United States. These transfers take place under each provider’s data processing terms; you can ask us for details of the safeguard that applies to each one.
9. Your rights
Under UK GDPR you have the following rights in relation to your personal data:
- Right of access: to ask for a copy of the personal data we hold about you.
- Right to rectification: to ask us to correct inaccurate personal data.
- Right to erasure: to ask us to delete your personal data, subject to our legal obligations to keep certain records.
- Right to data portability: to receive your data in a structured, commonly used, machine-readable format. The audit trail can be exported through the API as JSON or CSV.
- Right to object: to processing based on legitimate interests.
- Right to restrict processing: to ask us to restrict how we process your personal data in certain circumstances.
To exercise any of these rights, write to ceo@agentshield.online. We will respond within one month.
You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
10. Cookies and browser storage in the console
The console does not use advertising, tracking or analytics cookies.
- When you sign in to the console we set two strictly necessary cookies, each lasting at most 12 hours: an HttpOnly session cookie (
as_session) and a CSRF token cookie (as_csrf) that protects the changes you make. These cookies do not need consent.
- We do not store your API key in your browser. Some console pages use local storage only for display preferences, such as the selected time period, whether the event ticker is hidden, or your recent commands.
- The console loads its fonts from Google Fonts, so your browser sends your IP address to Google when the fonts load.
11. Children
Agent Shield is a business-to-business service and is not directed at anyone under 18. We do not knowingly collect personal data from children.
12. Changes to this policy
We may update this policy from time to time. We will tell you about material changes by email to your registered address at least 30 days before they take effect. The date at the top of this page shows when it was last revised.
13. Contact
Questions about this policy or our data practices: ceo@agentshield.online.
Post: Imperium Business Intelligence Ltd, 29 Cliffe Avenue, Margate, England, CT9 5DU.