Hosted in the EU
AgencyOS runs on European infrastructure, in the European Union, and data is encrypted in transit.
Security & access
Client access, built first and enforced in the database.
AgencyOS keeps each client to their own data with rules that live in the database itself, on every record, and anything those rules don’t explicitly allow is refused. Nothing new goes live without its own rule.
The guarantee
Five things a client never receives.
These things aren’t hidden on screen or filtered out at the last moment. They are never part of what a client’s browser receives in the first place, and every line below is checked automatically before anything we ship goes live.
| What never reaches them | Why it stays inside |
|---|---|
| Your time entries and notes | How long things took, and why |
| Your internal estimate | What you actually expect it to take. They only see the estimate you shared |
| Internal notes and pages | What your team says about them, among yourselves |
| Internal items and comments | The conversation about their request, and work they never asked for |
| Anything of another customer’s | Every list they open contains nothing belonging to anyone else |
Hidden means hidden
A client who asks for an internal item directly gets the same answer as for something that doesn’t exist. A polite “you’re not allowed to see this” would confirm it’s there, and that alone would be a leak.
No hours for any client
No time entry, no tracked total and no internal estimate ever reaches a client, on any screen, under any role, whatever they ask for.
Nothing new ships without it
Every new place your data can live gets its own access rule before it goes live, and if one is missing, the release stops.
Roles
Five roles, including one limited to named projects.
A client member sees only the projects you name for them, rather than everything their company has with you. That’s what makes it safe to invite a team lead who should see one project and nothing else.
People are deactivated, never deleted. They are signed out within seconds and lose all access, while their name stays on the feed entries, comments and hours they wrote.
| Role | Reaches | Time entries |
|---|---|---|
| Owner | Everything, including people and invites | |
| Employee | All customers and projects, or only the ones named for them | in scope |
| Freelancer | Assigned projects only | own |
| Client admin | Their company and all its projects | — |
| Client member | Named projects of their company only | — |
Data & operations
Where your data lives, and what happens to it.
An audit log of what matters
Who changed what and when is logged internally: visibility switches, edits, invites, shared links and deactivations. There’s no view or export of it in the app yet.
Export on request
Items, hours, feed, documents and attachments, in formats any spreadsheet can open. There’s no export fee and no waiting period: ask, and we run the export for you.
Sign-in that suits both sides
Sign in with a password or with a single-use link that expires after 15 minutes. Invite links work once, and nobody can use one to gain a bigger role than it was sent with.
Nothing you record is silently rewritten
Time is stored to the exact minute and never rounded when it’s saved. An edited feed entry says that it was edited, and the text it replaced is kept in the audit log.
No training on your data
Your items, hours and client conversations are never used to train anything, ours or anyone else’s. Sub-processors are listed, and you hear about a change before it happens.
Send us your security questionnaire.
Ask for the sub-processor list and the tests that check what a client can never see, all before you sign anything.