The Agined security pack
Two documents for a security review: a whitepaper that explains how Agined is built and run, and a vendor questionnaire already answered. Every statement links to the document that binds it.
Operated by Avonao, Inc.Web pages only, no downloadsNo certification is claimed
The two documents.
Both are plain pages. They describe how Agined works today; where something is not in place, or not documented, the page does not claim it.
How Agined is built and run
The path of a catalogued action call through policy, human approval, metering and evidence; tenant isolation and the seven data regions; receipt signing, the hash chain and offline verification; key management; access control and the audit log; incident and breach notice; sub-processors; compliance posture; responsible disclosure.
Read the whitepaper →QuestionnaireVendor security questionnaire, answered
Standard questions in ten groups: organisation, access control, data protection and residency, encryption, logging and monitoring, incident response, vulnerability management, sub-processors, business continuity, privacy and legal. Each answer is short and links to its source.
Open the questionnaire →When to use which.
| You are | Start with | Why |
|---|---|---|
| An engineer or architect who needs to know what happens to a call | The whitepaper | It follows one call from the gateway to the evidence it leaves, and says which checks refuse and which are best-effort. |
| Procurement or a security reviewer with a standard form | The questionnaire | The usual questions are answered with a source for each, so you can copy answers into your own form. |
| A data protection officer or lawyer | The questionnaire, then the DPA | Annex 2 of the Data Processing Addendum is the binding list of technical and organisational measures. |
| An auditor who wants to check evidence without us | The whitepaper, evidence section | It explains how a receipt or a dispute packet is verified offline with a published public key. |
| Someone whose own questionnaire is not covered | Email us | Send it to security@agined.com and the security team answers it. |
What is binding.
The pack explains and summarises. The documents below are the ones that bind Agined.
Data Processing Addendum
Security measures (Annex 2), breach notice, audits, sub-processors, international transfers and deletion.
Read the DPA →Key management
Which keys sign receipts, where they are held, how public keys are published and pinned, and what happens on compromise.
Read the policy →Receipt Practice Statement
What a receipt contains, how it is made, what it proves and what you still trust us for.
Read the statement →If Agined stops operating
What keeps working without us, what stops, and what we commit to if we wind the service down.
Read the commitment →Sub-processors
Every provider that processes data for Agined, with purpose, location and safeguards.
See the list →Responsible disclosure
How to report a vulnerability, the scope, the safe harbor and our response targets.
Read the policy →Questions and requests.
Security questions and your own questionnaires go to security@agined.com. Privacy questions go to privacy@agined.com. A vulnerability report can be anonymous.