AskHandle Security

AskHandle Overview

AskHandle is a cloud-based platform that helps organizations of all sizes deploy AI agents globally. It enables businesses to concentrate on training and deploying AI agents, while AskHandle handles the underlying infrastructure, scaling, and security management.

AskHandle applies security best practices and manages platform security so customers can focus on their business. The platform is designed to protect customers from potential threats by implementing security controls at every level, from physical to application layers. It also logically isolates each customer's workspace and data, and can deploy security updates without disruption to service or requiring customer intervention.

AskHandle’s Commitment to Trust

Trust is a core principle at AskHandle. Our commitment to customer privacy and building trust guides our daily decisions. Every employee shares in the responsibility of maintaining trust, and we take this duty seriously.

Security Assessments and Compliance

Infrastructure Providers

AskHandle runs on established cloud providers that each maintain their own independently audited security programs:

• Vercel hosts the AskHandle web application, APIs, and the web messenger script. Vercel’s platform runs primarily on Amazon Web Services (AWS) and serves traffic through a global edge network.
• Neon provides our managed PostgreSQL database. Our database runs in AWS data centers.
• Amazon Web Services (AWS) stores uploaded files in Amazon S3 and delivers media through Amazon CloudFront.
• Google Cloud runs long-running background jobs, such as document conversion and report generation, in isolated containers on Cloud Run.

Vercel holds a SOC 2 Type 2 attestation and ISO 27001:2022 certification, and supports PCI DSS v4.0 as a service provider. Neon maintains SOC 2 and ISO 27001 compliance and is audited annually by independent firms.

Data Centers

The AWS data centers underlying our infrastructure are accredited under:

• ISO 27001
• SOC 1, SOC 2, and SOC 3 (SSAE 18 / ISAE 3402)
• PCI DSS Level 1
• FedRAMP
• Sarbanes-Oxley (SOX)

PCI

We use Stripe, a PCI DSS Level 1 certified payment processor, to securely process credit card payments. Payment details are entered on Stripe-hosted checkout and billing pages, so card numbers are never transmitted to or stored on AskHandle’s servers.

Penetration Testing and Vulnerability Assessments

Third-party security testing of the AskHandle application is conducted by independent, reputable security consulting firms. The findings from each assessment are reviewed with the assessors, risk-ranked, and assigned to the relevant team for resolution.

Physical Security

AskHandle does not operate its own data centers. Our infrastructure providers run within ISO 27001-certified data centers managed by AWS and Google Cloud. Amazon has extensive experience designing, building, and operating large-scale data centers, and this expertise is applied throughout the AWS platform and infrastructure.

AWS data centers are in unmarked, secure facilities. Critical sites are protected by substantial setbacks, military-grade perimeter control berms, and other natural boundary defenses. Physical access to these facilities is strictly controlled, with security staff monitoring all perimeter and building entry points. The centers are equipped with video surveillance, advanced intrusion detection systems, and other electronic security measures.

Authorized personnel must undergo two-factor authentication at least three times before accessing data center floors. All visitors and contractors must present identification, sign in, and remain continuously escorted by authorized staff.

Amazon restricts data center access to employees with a legitimate business need. If an employee’s role no longer requires such access, their permissions are promptly revoked, regardless of their continued employment with Amazon or AWS. Additionally, all physical and electronic access to Amazon’s data centers is logged and regularly audited to ensure security.

For additional information see: https://aws.amazon.com/security

Environmental Safeguards

Fire Detection and Suppression

To minimize fire risk, automatic fire detection and suppression systems have been installed throughout the data center. The fire detection system uses smoke sensors in all critical areas, including data center environments, mechanical and electrical spaces, chiller rooms, and generator equipment rooms. These areas are protected by various fire suppression systems, such as wet-pipe, double-interlocked pre-action, or gaseous sprinkler systems.

Power

The data center’s electrical power systems are fully redundant and designed for continuous operation, ensuring no impact to services 24/7. Uninterruptible Power Supply (UPS) units provide backup power for critical and essential systems during electrical failures. Additionally, backup generators supply power to the entire facility, ensuring seamless operation even during extended outages.

Climate and Temperature Control

Maintaining a stable operating temperature is crucial to prevent hardware overheating and reduce the risk of service interruptions. The data centers are equipped with climate control systems that regulate temperature and humidity to optimal levels. Monitoring systems, along with on-site personnel, ensure that the environmental conditions remain within the required range for proper equipment performance.

Management

Data center staff continuously monitor the electrical, mechanical, and life support systems to promptly identify and address any issues. Preventative maintenance is regularly performed to ensure the ongoing reliability and functionality of all equipment.

For additional information see: https://aws.amazon.com/security

Network Security

Edge Network and Firewalls

All traffic to the AskHandle application passes through Vercel’s global edge network before it reaches our application code. Vercel’s platform firewall inspects incoming requests and blocks malicious traffic at the edge. Our application runs as managed serverless functions, so there are no customer-facing servers, open ports, or shell access to maintain or expose.

Our database is not directly exposed to customer traffic. Connections pass through Neon’s authenticating proxy, which verifies every connection before it reaches PostgreSQL and blocks repeated unauthorized login attempts.

DDoS Mitigation

Vercel provides automatic DDoS mitigation for all traffic to the AskHandle application. Attacks at the network and transport layers are detected and blocked at the edge, and global Anycast routing spreads traffic across Vercel’s network so that no single location becomes a bottleneck. We also apply rate limits to public endpoints, such as the web messenger, to protect against abuse.

Network Isolation

Our infrastructure providers segment their environments using private networks and security groups, restricting traffic between services to only what is required. AskHandle further mitigates risks by employing workspace-level data isolation in the application, least-privilege service credentials, and encrypted connections at all levels of the stack.

Data Security

PostgreSQL Database

Customer data is stored in a managed PostgreSQL database hosted by Neon, with strict access controls. Database credentials are unique, generated with high entropy, scoped to the minimum required permissions, and stored only in encrypted environment configuration. Customer data is logically isolated within the platform through enforced access controls at the application layer.

All connections to the database require TLS encryption, ensuring data in transit is always protected. Data at rest is encrypted with AES-256, with encryption keys managed through AWS Key Management Service (KMS). Neon manages security patching and maintenance of the database service.

AWS S3

Files uploaded as knowledge sources for your AI agents are securely stored in Amazon Web Services (AWS) S3. All objects in S3 are automatically encrypted at rest, and access to the storage bucket is restricted to AskHandle’s services through AWS Identity and Access Management (IAM) policies. Where files need to be accessed directly, we use short-lived, signed URLs. S3 complies with a wide range of regulatory standards, including PCI DSS, HIPAA/HITECH, FedRAMP, GDPR, and FISMA, and AWS provides comprehensive auditing capabilities to track access requests to S3 resources.

Web Messenger

The web messenger is a chat component that can be added to your website to facilitate AI communication with visitors. The messenger script is served over HTTPS from AskHandle’s application on Vercel’s edge network, and media assets are delivered through Amazon CloudFront. Messenger traffic benefits from the same edge firewall, DDoS mitigation, and rate limiting that protect the rest of the AskHandle platform.

Encrypt Data in Transit

We use HTTPS (TLS 1.2 or higher) for all applications and TLS for all database connections to ensure the security of sensitive data during transmission to and from the applications.

Vulnerability Management

Our vulnerability management process is designed to address risks without requiring customer interaction or causing any impact. AskHandle is alerted to vulnerabilities through a combination of internal and external assessments, dependency and patch monitoring, and third-party mailing lists and services. Each identified vulnerability is reviewed to determine its relevance to AskHandle’s environment, ranked by risk, and assigned to the appropriate team for resolution.

Because our hosting, database, and storage are fully managed services, operating system and infrastructure patches are applied by our providers without downtime.

AskHandle Platform Security

We conduct regular penetration tests, vulnerability assessments, and source code reviews to evaluate the security of our applications, architecture, and implementations. Third-party security assessments are performed across all areas of our platform, including testing for OWASP Top 10 web application vulnerabilities and verifying isolation between customer workspaces. AskHandle collaborates closely with external security assessors to ensure the platform and applications are secure and follow industry best practices.

Any issues identified within the AskHandle platform are risk-ranked, prioritized, and assigned to the appropriate team for remediation. Our security team reviews each remediation plan to ensure that the issue is resolved effectively and thoroughly.

Backups

Our database is hosted on Neon, a managed PostgreSQL service with continuous data protection built in. All data changes are captured in write-ahead logs (WAL), which are durably replicated across multiple availability zones before a change is confirmed, and then stored in high-durability cloud object storage.

Point-in-time recovery (PITR) is enabled, allowing the database to be restored to any point within the retention window. Backup storage is encrypted at rest and protected by strict access controls.

Our infrastructure is designed to be fault-tolerant. Failed components are replaced automatically, minimizing the need for manual intervention and reducing the risk of data loss.

Disaster Recovery

Platform and Databases

Our platform runs on serverless, managed cloud infrastructure designed for automatic scaling and high availability. Vercel Functions run with redundancy across multiple availability zones, and Vercel automatically reroutes traffic to healthy regions if a regional outage occurs. Every deployment is immutable, so a previous known-good version of the application can be restored immediately.

Our database storage is replicated across multiple availability zones. If a database compute instance fails, Neon automatically starts a replacement and reconnects it to the same durable storage, enabling rapid recovery with minimal data loss.

Customer Data Retention and Destruction

You have the flexibility to purge data from our databases to meet your own data retention requirements. If you close your account and request data removal, we will retain your data for 30 days. After this period, the data is permanently deleted and rendered unrecoverable.

The decommissioning of hardware is handled by our infrastructure providers through a process designed to prevent any exposure of customer data. AWS follows established data destruction standards, including NIST 800-88 (“Guidelines for Media Sanitization”), to ensure complete and secure data destruction.

For additional information see: https://aws.amazon.com/security

Privacy

AskHandle has a published Privacy Policy that clearly outlines the types of data collected and how it is used. We are committed to ensuring customer privacy and maintaining transparency in our practices.

We take proactive steps to safeguard customer privacy and protect the data stored on our platform. AskHandle provides built-in protections including role-based access controls, encrypted data transport, HTTPS for all customer-facing applications, and encryption of stored data at rest. For more information, please refer to our Privacy Policy.

GDPR commitment

We are dedicated to supporting our customers’ success, including ensuring compliance with the GDPR.

Compliance with the GDPR is a shared responsibility between AskHandle and our customers in how they use our services. AskHandle commits to fully complying with the GDPR in delivering our services. We are also focused on helping our customers meet their own GDPR compliance obligations. We have thoroughly reviewed the GDPR requirements and are actively making improvements to our products, contracts, and documentation to support full compliance.

WCAG 2.0 commitment

At AskHandle, we are dedicated to making our platform accessible to all users, including those with disabilities. We follow the Web Content Accessibility Guidelines (WCAG 2.0) at both Level A and Level AA to ensure that our web content is perceivable, operable, and understandable for everyone. By adhering to these standards, we aim to create an inclusive experience that meets the diverse needs of our users and ensures equal access to all our digital resources.

Personal Information Protection Law (PIPL) commitment

AskHandle is committed to adhering to the principles set forth in the Personal Information Protection Law (PIPL) of the People’s Republic of China. We prioritize the protection of personal data and ensure full compliance with PIPL regulations. This includes transparent data collection practices, secure processing and storage of personal information, and respecting individuals’ rights to control their data. By following these legal requirements, we aim to protect user privacy and uphold the highest standards of data security.

Access to Customer Data

AskHandle staff does not access or interact with customer data or applications during regular operations. There may be instances where AskHandle is requested to access customer data or applications for support purposes, or when required by law. Access to customer data is strictly controlled, and any interaction by AskHandle staff is authorized by the customer or mandated by the government. All access is documented, including the reason for access, actions taken, and the start and end times of support.

Employee Screening and Policies

As a condition of employment, all AskHandle employees undergo pre-employment background checks and must agree to company policies, including security and acceptable use policies.

Security Team

Our security team is led by the Chief Information Security Officer (CISO) and includes staff dedicated to application and information security. The team collaborates closely with both AskHandle employees and customers to manage risks and uphold our commitment to trust.