Details

Announcing Agent Commander - The First Integrated solution from Veeam + Securiti.ai enabling the scaling of safe AI agents

https://securiti.ai/press-release/veeam-introduces-agent-commander-to-confront-agentic-ai-risk-at-enterprise-scale/

Security & Compliance

Overview

Securiti respects our customers' privacy and keeping our customers' data protected at all times is our highest priority. This security policy provides a high-level overview of the security practices put in place to achieve that objective.

Have questions or feedback? Feel free to reach out to us at [email protected].

Dedicated security team

Our security team comprises security experts dedicated to improving the security of our organization. Our team has played lead roles in designing and building highly secure Internet facing systems at companies ranging from startups to large public companies like Symantec, BlueCoat, Cisco, Qualys, Elastica and WiChorus. Our employees are trained on security incident response and are on call 24/7.

Infrastructure

Our solution is hosted on Amazon Web Services(AWS) and Google Cloud(GCP). AWS and GCP are responsible for the security of the underlying cloud infrastructure and SECURITI owns the responsibility of securing the workloads we deploy on them. AWS and GCP computing environments are continuously audited, with certifications from accreditation bodies across geographies and verticals, including ISO 27001, FedRAMP, DoD CSM, and PCI DSS. You can read more about their practices in the links here: https://aws.amazon.com/security/, https://cloud.google.com/security.

Securiti is SOC2 Type II certified. A copy of the SOC2 certificate can be made available upon request to prospective and current customers. Securiti also holds the ISO 27001:2022 and ISO 27701:2019 certifications.

Our solution is engineered to make use of multiple availability zones in a given AWS (or GCP) region and autoscales as needed to provide a highly available and reliable service.

Network level security monitoring and protection

Securiti’s network architecture consists of multiple security zones with different tiers confined to their own zones. In particular, internet-facing endpoints are in their own zone and do not have direct access to the database tier or other internal services.

For AWS environments, AWS GuardDuty is used to actively monitor all cloud trail and VPC flow logs for any anomalies or security incidents. AWS Security Hub is used to check all the infrastructure policies and configuration against best practices and raise alerts. A well-known open-source Host-based Intrusion Detection (HIDS) is used to monitor both the hosts and containers. AWS WAF provides the Web Application Firewall protection.

For GCP environments, GCP Cloud IDS is used to actively monitor all north-south traffic for any anomalies or security incidents. GCP SCC is used to check all the infrastructure policies and configuration against best practices and raise alerts. GCP Cloud Armor provides the Web Firewall protection.

The host and container images are scanned periodically for vulnerabilities - any vulnerabilities found are patched as per industry and SOC2 guidelines.

DDoS protection

We use AWS Shield and Google Cloud Armor as the Distributed Denial of Service (DDoS) mitigation service.

Encryption

Encryption in transit

All data sent to or from our infrastructure is encrypted in transit via industry best-practices using Transport Layer Security (TLS).

Encryption at rest

Any device storing any data is subjected to data-at-rest encryption. Thus, a decommissioned device cannot be misused. The encryption keys for at-rest encryption are rotated annually.

Any customer data that is identified and cataloged by SECURITI as personal data is subjected to a one-way, irreversible hash and stored in the virtual database instance of the customer. At no point, such cataloged personal data is captured in clear-text in logs or databases.

All sensitive configuration data (e.g. passwords, database or SaaS credentials) is encrypted using best practice encryption algorithms in the database. The encryption key is rotated annually.

Data retention and removal

We retain our customers’ data for a period of one business week after a deletion request is received. All data is then completely removed from our systems. Every customer can request the removal of their account by contacting support.

Business continuity and disaster recovery

We back up all our critical assets on a daily basis and regularly attempt to restore the backup to guarantee a fast recovery in case of disaster. All our backups are encrypted. All critical assets are configured with redundancy and thus provide high availability. Daily backups are copied over to a different AWS or GCP region for disaster recovery. The securiti services are provisioned in the Disaster Recovery region using the pilot light strategy for a quick recovery.

Patch Management

We use AWS Inspector to check for vulnerabilities in our host images and Sysdig Anchore to check for vulnerabilities in our container images.
Critical and severe vulnerabilities are addressed in the current release under test. All other vulnerabilities are scheduled for future releases.
If a critical or severe vulnerability impacts any internet-facing application, we study the conditions under which the vulnerability can be exploited and, if we conclude that our applications are susceptible to exploitation, we patch our production systems immediately with a hot-fix, usually with a turn-around time of less than a day.

Application security monitoring

We use a security monitoring solution to get visibility into our application security, identify attacks and respond quickly to a data breach. We also use technologies to monitor exceptions, logs and detect anomalies in our applications.
We collect and store logs to provide an audit trail of our applications activity
Security events are logged and notifications are sent in case of critical attacks to allow for fast remediation.

Application security protection

We use AWS WAF and GCP Cloud Armor as Web Application Firewalls to identify and block the OWASP Top 10 attacks in real-time.
We use security headers to protect our application from various attacks. Please check https://securityheaders.io/?q=app.securiti.ai&hide=on&followRedirects=on for our current grade.

Secure development

Our development methodology follows security best practices and frameworks (e.g. OWASP Top 10).

Developers participate in regular security training to learn about common vulnerabilities and threats
We review our code for security vulnerabilities
We regularly scan our host and container images to address the known vulnerabilities and also proactively update the dependencies.
We use static code analysis to identify defective code.
With every major release, we use the https://portswigger.net/burp Suite to check for vulnerabilities and remediate them as per the industry-standard best practices by taking their severity into account.

Responsible disclosure

Securiti is dedicated to keeping its cloud platform safe from all types of security issues thereby providing a safe and secure environment to our customers. Data security is a matter of utmost importance and a top priority for us. If you are a dedicated security researcher or vulnerability hunter and have discovered a security flaw in the Securiti platform including the cloud application and infrastructure, we appreciate your support in disclosing the issue to us in a responsible manner. Our responsible disclosure process is managed by the security team at Securiti. We are always ready to recognize the efforts of security researchers by rewarding them with a token of appreciation, provided the reported security issue is of high severity and not known to us. While reporting the security vulnerability to Securiti’s Security team, please refrain from disclosing the vulnerability details to the public outside of this process without explicit permission. Please provide the complete details. We determine the impact of vulnerability by looking into the ease of exploitation and business risks associated with the vulnerability.

As a security researcher, if you identify or discover a security vulnerability in compliance with the responsible disclosure guidelines, Securiti’s security team commits to:

Acknowledge the receipt of reported security vulnerability in a timely fashion

Notify you when the vulnerability is remediated
Extend our gratitude by providing a token of appreciation in supporting us to make our customers safe and secure
Please send the details of the discovered vulnerability or any security issue to: [email protected]

Accepted vulnerabilities are the following

[https://securiti.ai/glossary/cross-site-scripting-attack-xss/](Cross-Site Scripting (XSS))
Open redirect
Cross-site Request Forgery (CSRF)
Command/File/URL inclusion
Authentication issues
Code execution
Code or database injections

This bug bounty program does NOT include

Account/email enumerations
Denial of Service (DoS)
Attacks that could harm the reliability/integrity of our business
Spam attacks
Clickjacking on pages without authentication and/or sensitive state changes
Mixed content warnings
Lack of DNSSEC
Content spoofing / text injection
Timing attacks
Social engineering
Phishing
Insecure cookies for non-sensitive cookies or 3rd party cookies
Vulnerabilities requiring exceedingly unlikely user interaction
Exploits that require physical access to a user's machine

User protection

As with most cloud services, access to the Securiti platform requires a login ID and password or integration with a Single-Sign-On (SSO) provider. When an organization subscribes to the Securiti platform service, it is the customer’s responsibility to manage which end users should be given access. Customers should also define when access should be taken away from the end users. For example, access should be revoked upon end user’s separation from employment or as part of departmental changes that result in change of duties or responsibilities. Only valid account credentials should be used by authorized users to access the Securiti platform service.

Brute-force password attacks are thwarted by requiring users to answer a captcha if our application is not integrated with a single-sign-on vendor.

Single sign-on

Single sign-on (SSO) can be implemented by our enterprise customers. We recommend making use of the additional protections (such as 2FA) that are offered by SSO vendors.

Role-based access control

Advanced role-based access control (RBAC) is offered on all our customer accounts and allows our users to define roles and permissions.

Compliance

California Consumer Privacy Act (CCPA)

We’re compliant to the California Consumer Privacy Act (CCPA). Our commitment towards CCPA is outlined https://securiti.ai/terms/.

General Data Protection Regulation (GDPR)

We’re compliant to the General Data Protection Regulation (GDPR). The purpose of GDPR is to protect the private information of EU citizens and give them more control over their personal data. Contact us for more details on how we comply to GDPR.

Payment information

All self-serve payment instrument processing is safely outsourced to Stripe which is certified as a PCI Level 1 Service Provider. We don’t collect any payment information and are therefore not subject to PCI obligations.

Employee access

Our strict internal procedure prevents any employee from gaining access to customer data. A subset of SECURITI's Personnel have access to customer data as necessary to support the platform. Individual access is granted based on the role and job responsibilities of the individual. Access to systems containing customer data is reviewed on a regular basis and is monitored on an ongoing basis. Our employees sign a Non-Disclosure and Confidentiality Agreement to protect our customers' sensitive information.

[https://securiti.ai/](

)

At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.

[https://securiti.ai/llms/](Hey AI, learn about us)

Newsletter

Company

[https://securiti.ai/about/](About Us)
https://securiti.ai/careers/
[https://securiti.ai/contact-us/](Contact Us)
[https://securiti.ai/partner-program/](Partner Program)
[https://securiti.ai/news-coverage/](News Coverage)
[https://securiti.ai/press-release/](Press Releases)

Resources

https://securiti.ai/blog/
https://securiti.ai/collateral/
[https://education.securiti.ai](Securiti Education)
[https://securiti.ai/privacy-center/](Privacy Center)
[https://securiti.ai/what-is-dspm/](What is DSPM)

Terms

[https://securiti.ai/terms/#privacy-policy](Terms & Policies)
[https://securiti.ai/security/](Security & Compliance)
[#](Manage cookie preferences)
[https://securiti.ai/my-privacy-center/](My Privacy Center)
[https://privacy-central.securiti.ai/#/dsr/d3672e72-17cd-4ae9-b769-b0b31aab05aa](Do not Sell or Share Information)

Get in touch

[email protected]

Securiti, LLC.

3155 Olsen Drive

Suite 325

San Jose, CA 95117

[https://twitter.com/SecuritiAI](

)

[https://www.facebook.com/securitiai](

)

[https://www.linkedin.com/company/securitiai/posts/?feedView=all](

)

https://securiti.ai/reports/securiti-most-innovative-dspm-leader-frost-sullivan/

https://securiti.ai/reports/

https://securiti.ai/reports/privacy-mangement-forrester-wave-report/

https://securiti.ai/press-release/securiti-named-a-worldwide-leader-in-idc-marketscape-2023/

https://securiti.ai/reports/securiti-gigaom-dspm/

https://www.rsaconference.com/library/press-release/securitiai-named-most-innovative-startup-at-rsa-conference-innovation-sandbox

https://securiti.ai/press-release/securiti-named-most-innovative-artificial-intelligence-startups/

https://www.g2.com/products/securiti/reviews

https://securiti.ai/press-release/securiti-ai-wins-coveted-iapp-privacy-innovation-award/

javascript:void(0)

https://securiti.ai/

[https://securiti.ai/contact-us/](Contact Us) [https://securiti.ai/request-demo/](See a demo)

[https://securiti.ai/](Data Command Center)

[#](Data+AI Security Teams )

[#](Data+AI Teams )

[#](Data Governance Teams )

[#](Data Privacy Teams )

[https://securiti.ai/products/data-security/](Secure Data+AI anywhere )

Data Security Posture Management Secure sensitive data everywhere from hybrid multicloud to SaaS

https://securiti.ai/dspm/

Agent Commander Detect AI risk. Protect AI systems. Undo AI mistakes.

https://securiti.ai/agent-commander/

Security for AI Agents and Copilots Ensure robust data protection while scaling AI agents and copilots. Learn how to accelerate AI agents adoption securely across the enterprise

https://securiti.ai/products/security-for-ai-agents-and-copilots/

Data Access Intelligence & Governance Monitor user access to data and enforce least privilege controls

https://securiti.ai/products/access-intelligence/

Data Discovery & Classification Discover shadow and cloud-native assets and accurately classify data

https://securiti.ai/products/sensitive-data-intelligence/

Compliance Management Assess & improve compliance with security best practices frameworks

https://securiti.ai/products/compliance-management/

Breach Impact Analysis Analyze breach impact & automate notifications to affected individuals

https://securiti.ai/products/data-breach-investigation/

Data Flow Governance Understand data lineage and secure real-time streaming data

https://securiti.ai/products/data-streaming-analysis/

[https://securiti.ai/gencore/](Build safe enterprise AI systems )

Safe Enterprise AI Copilots Implement rule-aware AI copilots across your organization’s data anywhere

https://securiti.ai/gencore/safe-enterprise-ai-copilot/

Data Vectorization and Ingestion Extract info from complex Unstructured Files, convert it into AI-ready formats, and sync to vector databases

https://securiti.ai/gencore/sync-unstructured-data-to-vector-dbs/

Data Curation and Sanitization for AI Transform raw, unstructured files into data ready for model training and tuning

https://securiti.ai/gencore/curate-and-sanitize-unstructured-data-for-ai/

Context-aware LLM Firewalls Protect AI interactions with intelligent retrieval, response, and prompt firewalls

https://securiti.ai/gencore/llm-firewalls/

Unstructured Data Governance Manage and govern unstructured data to enable its safe use with generative AI

https://securiti.ai/gencore/unstructured-data-governance/

[https://securiti.ai/products/data-governance/](Govern data for safe innovation )

Data Discovery & Classification Discover shadow and cloud-native assets and accurately classify data

https://securiti.ai/products/data-classification/

Unstructured Data Governance Manage unstructured data to enable safe use with generative AI

https://securiti.ai/products/data-governance/

Data Access Governance Monitor sensitive data access and prevent unauthorized use

https://securiti.ai/products/access-intelligence/

AI Governance Establish controls for safe adoption of AI technologies including GenAI

https://securiti.ai/products/ai-security-governance/

Data Catalog Enable users to easily find, understand, trust and access the data they need

https://securiti.ai/products/data-catalog/

Data Lineage Automatically track changes and transformations of data throughout its lifecycle

https://securiti.ai/products/data-lineage/

Data Quality Conduct data quality checks and validation across various data types

https://securiti.ai/products/data-quality/

[https://securiti.ai/products/data-privacy/](Automate data privacy operations )

Data Mapping Automation Manage your entire data mapping lifecycle and automate RoPA reports

https://securiti.ai/products/data-mapping/

AI Governance Comply with emerging AI regulations and ensure safe use of AI

https://securiti.ai/products/ai-security-governance/

Data Subject Request Automation Automate entire DSR lifecycle from consumer request intake to secure report delivery

https://securiti.ai/products/data-subject-request-automation/

Assessment Automation Automate your entire assessment lifecycle and demonstrate compliance

https://securiti.ai/products/assessment-automation/

Compliance Management Use automation to audit and improve compliance with global regulations and industry standards

https://securiti.ai/products/compliance-management/

Consent Management Manage your first-party and third-party consent lifecycle from scanning to reporting

https://securiti.ai/products/consent-management-platform/

Mobile App Consent Management Seamlessly track and manage user consent with your mobile app, get compliant with all major global regulations.

https://securiti.ai/products/mobile-app-consent-management/

Breach Management Automate your incident management and optimize notifications to users & regulatory bodies

https://securiti.ai/products/breach-management/

Privacy Center Elegant Consumer Frontend, Fully Automated Backend, Privacy Regulation Intelligent Everywhere

https://securiti.ai/privacy-center/

GCP

https://securiti.ai/gcp/

AWS

https://securiti.ai/aws/

Databricks

https://securiti.ai/databricks/

Snowflake

https://securiti.ai/snowflake/

Azure

https://securiti.ai/azure/

https://securiti.ai/connectors/

Finance

https://securiti.ai/products/dataai-security-for-financial-services/

Healthcare

https://securiti.ai/products/dataai-security-for-healthcare/

Telecom

https://securiti.ai/products/dataai-security-for-telecom/

Retail

https://securiti.ai/products/dataai-security-for-retail/

CDMC

https://securiti.ai/cdmc/

EU AI Act

https://securiti.ai/eu-ai-act/

OWASP Mitigate AI Security Risks with the Broadest Coverage of OWASP Top 10 for LLMs

https://securiti.ai/owasp-top-10-for-llm-applications/

NIST AI RMF

https://securiti.ai/nist/

European Union GDPR

https://securiti.ai/solutions/gdpr/

California's CPRA

https://securiti.ai/solutions/cpra/

Brazil's LGPD

https://securiti.ai/solutions/lgpd/

Canada's PIPEDA

https://securiti.ai/solutions/pipeda/

China's PIPL

https://securiti.ai/solutions/china-pipl/

https://securiti.ai/solutions/

Data+AI Builders

https://securiti.ai/gencore/

Data Security

https://securiti.ai/products/data-security/

Data Privacy

https://securiti.ai/products/data-privacy/

Data Governance

https://securiti.ai/products/data-governance/

Marketing

https://securiti.ai/products/marketing/

Blog

https://securiti.ai/blog/

Collateral

https://securiti.ai/collateral/

Knowledge Center

https://securiti.ai/knowledge-center/

Securiti Education

http://education.securiti.ai/

Webinars

https://securiti.ai/webinars/

About Us

https://securiti.ai/about/

Partner Program

https://securiti.ai/partner-program/

https://securiti.ai/contact-us/

News Coverage

https://securiti.ai/news-coverage/

Press Releases

https://securiti.ai/press-release/

Careers

https://securiti.ai/careers/

https://securiti.ai/events/
[https://securiti.ai/spotlight-talks/](Spotlight Talks)
[https://securiti.ai/gencore/](Gencore AI)
#
[https://securiti.ai/what-is-dspm/](What is DSPM)
[https://securiti.ai/dspm-vs-cspm/](DSPM vs CSPM)
[https://securiti.ai/dspm-use-cases/](DSPM Use Cases)

Please enter a minimum of 3 characters to begin your search.

Type

All BlogKnowledge CenterEventsSpotlight TalksVideosBrochureseBooksInfographicsWhite PapersReportsAssessmentsTemplatesAI RoundupPrivacy RoundupRegulationsPrivacy LawsNIST Resource CenterEU AI ActPress ReleasesNews

Filter by

All AI Governance AI Security AI Security & Governance Announcements Asset & Data Discovery Data Access & Intelligence Governance Data Access Governance Data Breach Impact Analysis & Response Data Catalog Data Consent Automation Data Flow Intelligence & Governance Data Governance Data Lineage Data Privacy Automation Data Security Data Security Posture Management EU AI Act Gencore AI Sensitive Data Intelligence Unstructured Data Governance

Filter by

All AI Governance AI Security Asset and Data Discovery Canadian Health Privacy Law Data Access Intelligence & Governance Data Catalog Data Consent Automation Data Governance Data Privacy Automation Data Security Data Security Posture Management EU AI Act Gencore AI Sensitive Data Intelligence Unstructured Data Governance

Videos

[https://securiti.ai/videos/rehan-jalil-veeam-on-agent-commander-thecube-nyse-wired/](View More)

March 9, 2026

[https://securiti.ai/videos/rehan-jalil-veeam-on-agent-commander-thecube-nyse-wired/]( Rehan Jalil, Veeam on Agent Commander : theCUBE + NYSE Wired: Cyber Security Leaders )

Following Veeam’s acquisition of Securiti, the launch of Agent Commander marks an important step toward helping enterprises adopt AI agents with greater confidence. In...

[https://securiti.ai/videos/mitigating-owasp-top-10-for-llm-applications/](View More)

January 20, 2025

[https://securiti.ai/videos/mitigating-owasp-top-10-for-llm-applications/]( Mitigating OWASP Top 10 for LLM Applications 2025 )

Generative AI (GenAI) has transformed how enterprises operate, scale, and grow. There’s an AI application for every purpose, from increasing employee productivity to streamlining...

[https://securiti.ai/videos/top-6-dspm-use-cases/](View More)

January 15, 2025

[https://securiti.ai/videos/top-6-dspm-use-cases/]( Top 6 DSPM Use Cases )

With the advent of Generative AI (GenAI), data has become more dynamic. New data is generated faster than ever, transmitted to various systems, applications,...

[https://securiti.ai/videos/colorado-privacy-act-cpa/](View More)

January 2, 2025

[https://securiti.ai/videos/colorado-privacy-act-cpa/]( Colorado Privacy Act (CPA) )

What is the Colorado Privacy Act? The CPA is a comprehensive privacy law signed on July 7, 2021. It established new standards for personal...

[https://securiti.ai/videos/securiti-for-ai-copilots/](View More)

December 24, 2024

[https://securiti.ai/videos/securiti-for-ai-copilots/]( Securiti for Copilot in SaaS )

Accelerate Copilot Adoption Securely & Confidently Organizations are eager to adopt Microsoft 365 Copilot for increased productivity and efficiency. However, security concerns like data...

[https://securiti.ai/videos/using-unstructured-data-with-genai/](View More)

November 1, 2024

[https://securiti.ai/videos/using-unstructured-data-with-genai/]( Top 10 Considerations for Safely Using Unstructured Data with GenAI )

A staggering 90% of an organization's data is unstructured. This data is rapidly being used to fuel GenAI applications like chatbots and AI search....

[https://securiti.ai/videos/gencore-ai-safe-enterprise-ai/](View More)

October 29, 2024

[https://securiti.ai/videos/gencore-ai-safe-enterprise-ai/]( Gencore AI: Building Safe, Enterprise-grade AI Systems in Minutes )

As enterprises adopt generative AI, data and AI teams face numerous hurdles: securely connecting unstructured and structured data sources, maintaining proper controls and governance,...

[https://securiti.ai/videos/navigating-cpra-key-insights-for-businesses/](View More)

August 12, 2024

[https://securiti.ai/videos/navigating-cpra-key-insights-for-businesses/]( Navigating CPRA: Key Insights for Businesses )

What is CPRA? The California Privacy Rights Act (CPRA) is California's state legislation aimed at protecting residents' digital privacy. It became effective on January...

[https://securiti.ai/videos/navigating-the-shift-transitioning-to-pci-dss-v4-0/](View More)

June 3, 2024

[https://securiti.ai/videos/navigating-the-shift-transitioning-to-pci-dss-v4-0/]( Navigating the Shift: Transitioning to PCI DSS v4.0 )

What is PCI DSS? PCI DSS (Payment Card Industry Data Security Standard) is a set of security standards to ensure safe processing, storage, and...

[https://securiti.ai/videos/securing-data-ai-playbook-for-trust-risk-and-security-management-trism/](View More)

January 29, 2024

[https://securiti.ai/videos/securing-data-ai-playbook-for-trust-risk-and-security-management-trism/]( Securing Data+AI : Playbook for Trust, Risk, and Security Management (TRiSM) )

AI's growing security risks have 48% of global CISOs alarmed. Join this keynote to learn about a practical playbook for enabling AI Trust, Risk,...

Spotlight Talks

Spotlight