Security

Agenta connects to your inbox and calendar, so we treat that access as sensitive by default. This page describes what Agenta can and cannot do, and how your data is protected.

What Agenta can access

We request the narrowest scopes that make the product work, and no more:

• Gmail, read only. Agenta can read messages to detect the requests aimed at you. It cannot send, reply, delete, or modify anything in your mailbox.
• Calendar, read plus create and edit events. Read access lets Agenta show your schedule alongside your tasks. Write access is used only to add or update events you ask it to create; it does not touch unrelated events.

No other Google, Microsoft, or Apple data is requested. Google and Microsoft show the exact permissions on their consent screens. Apple Calendar uses an app-specific password that can access iCloud Calendar without exposing your main Apple Account password.

Scanning is manual

Agenta does not run in the background. It reads your inbox only when you press Scan, so nothing is processed without an explicit action from you.

Credentials at rest

The provider tokens and Apple app-specific passwords that let Agenta reconnect are encrypted with AES-256-GCM before they are written to the database. The encryption key lives in the application environment, never in the database, so a database dump alone yields ciphertext only, not usable credentials.

In transit & isolation

All traffic is encrypted in transit over TLS. Stored tasks, updates, and calendar data are protected by row-level access rules enforced in the database: a person only ever sees their own data, and a collaborator only sees what was explicitly shared with them. Isolation is enforced by policy, not by convention in application code.

Revoke and delete, any time

Disconnecting an account deletes Agenta's encrypted credential and cached calendar data. Google tokens are also revoked upstream when possible. Apple app-specific passwords can be revoked from Apple Account settings. You can review Google access from your Google account permissions, or manage Apple app-specific passwords at account.apple.com. To remove everything, delete your account and Agenta-owned data from Settings. See the Privacy Policy for what is stored and shared.

Reporting an issue

Found a vulnerability? Submit a Security report through the Contact page. Please avoid including live credentials or unnecessary personal data in your report.

Agenta is currently an alpha product and has not yet been independently audited. Avoid connecting regulated or business-critical accounts until that review is complete. This page is a description of current practices, not a contractual guarantee.