Security
Security for Teams That Set a High Bar
Magier AI serves enterprise security and GRC teams. We hold our data handling to the same scrutiny we ask customers to apply.
Data Handling
Data Access and Use
Magier AI connects to identity providers, network proxy logs, and SaaS platform data to find AI tools in use. We examine access patterns and tool identifiers, not message content, documents, or personal communications. Discovery data remains for up to 12 months for trend analysis. After account termination, all data is deleted within 30 days.
No content read
We access identity and access metadata only. Emails, documents, chat messages, and user-created content are not read.
Tenant isolation
Application and storage layers logically separate your data from other customers. Cross-tenant queries are not permitted.
Data export
Export your inventory and evidence records whenever needed. After termination, all data is deleted within 30 days.
Infrastructure Controls
How We Protect Your Data
Data encryption
Stored data uses AES-256 encryption. Data in transit uses TLS 1.2 or higher.
Access control
Production access requires SAML 2.0 SSO with MFA enforced. Role-based permissions follow least privilege.
Audit logs
Access to customer data environments is logged. Logs remain available for 12 months and undergo regular review.
Cloud hosting
Magier AI operates on AWS, using managed services configured according to AWS security guidance.
Vulnerability response
We scan regularly and patch known critical findings within 72 hours of identification.
Continuity planning
Redundant infrastructure supports a 4 hours recovery time objective and a 1 hour recovery point objective.
Compliance Posture
Our Security Program
We use the frameworks we support in our own operations. Our program follows SOC 2 Type II requirements and ISO 27001 controls. Certification is underway. Enterprise customers may request our current security documentation package, including a data processing agreement, under NDA.
DPA
Available on request. We answer DPA requests within 30 days and sign standard agreements.
Subprocessors
We keep a current subprocessor list and provide at least 30 days advance notice of changes.
Disclosure process
Send vulnerability reports to [email protected]. We acknowledge them within 24 hours and aim to share status updates within 72 hours.
Questions on security practices?
We can answer detailed security questions, provide documentation to customers under NDA, and review controls against procurement or compliance requirements.