Security

Quality records that stay controlled and attributable.

AGNOCheck protects access, evidence and integrations while keeping the operational record useful for the people who are allowed to see it.

Workspace-scopedData separated by workspace

Protected evidencePrivate upload access

Role-basedPermissions by responsibility

Offline encryptedProtected on device

TraceableActions and revisions connected

AGNOCheck evidence record with photos, person and verification state

Protected quality record

Access and separation

The right record for the right person.

AGNOCheck scopes operational data to the active workspace, role and object. Customer accounts can be restricted to selected objects instead of receiving broad workspace access.

Separate workspaces — operational state and membership belong to one workspace context.
Object-scoped customers — ongoing customer accounts see only the selected objects.
Custom permissions — plans, execution, evidence, approval, complaints, people and audit access can be separated.

Five protection layers

Security follows the quality loop.

Protection is applied where the work happens: at sign-in, in the field, around evidence, during review and through integrations.

Authenticate

Management access uses the AGNO sign-in flow and server-side session handling.

Authorize

Roles and object scope decide which actions and records are available.

Protect evidence

Private file URLs are not exposed through public customer or integration responses.

Keep context

Plan revision, identity, evidence and decisions stay connected for later review.

Limit integrations

Preview APIs are read-only, workspace-scoped and use explicit privacy-safe serializers.

Secure offline work

A lost signal should not mean lost work.

Field records can be saved locally when the device is offline. The local queue is encrypted and designed to synchronize safely when the connection returns.

AES-GCM encryption with a device key derived through PBKDF2.
Automatic expiry limits how long offline access remains available.
Attempt lockout slows repeated failed access attempts.
Conflict visibility keeps revision conflicts and duplicate evidence from disappearing silently.

AGNOCheck mobile checklist used during field work

Encrypted offline queue

Evidence and integrations

Private information stays out of public responses.

Customer and integration access receive purpose-built data instead of a raw copy of the internal workspace state.

Protected evidence access

Evidence files are served through protected routes. Customer review and account scope are checked before a private upload is returned.

Evidence record with protected photo proof

Read-only integration boundary

The preview REST API and MCP tools expose selected operational data but exclude upload URLs, review tokens, contacts and internal AI provenance.

Rotatable workspace credentials

Integration credentials are workspace-specific and stored as hashes, so tokens can be replaced without exposing the stored secret.

AI preview boundary

AI assists. People decide.

Contract analysis and plan translation remain preview capabilities. Extracted requirements and translated plan content require human review before they become operational.

No automated credit or acceptance decision.
Source-revision context remains attached to translations.
Production provider validation is completed before preview labels are removed.

AGNOCheck dashboard showing the controlled quality record

Human review required

Security questions?

Review the privacy policy or contact us with the access, storage or integration requirements relevant to your operation.

Read the Privacy Policy Contact us