Encryption
Every exchange travels over HTTPS. The secrets you give Squadico — AI provider keys, integration tokens, SMTP passwords — are encrypted in the database with AES-256-GCM: a database dump does not reveal them.
Security and privacy
Last updated: October 29, 2026
Your agents read your documents, talk to your customers and act in your tools. Here is what Squadico does to protect that data — only measures the product actually applies.
Hosted in the European Union
Squadico runs on Google Cloud, in the europe-west1 region (Belgium). The database is hosted in the Netherlands and files are stored in Belgium: your data stays in the European Union.
How your data is protected
Your own AI provider
Squadico has no AI provider of its own. Your organization brings its key and chooses its provider: what your agents send to a model goes only to the provider you contracted with.
Isolation between organizations
Every agent, document, conversation and secret belongs to one organization, and every request is checked against it: an organization never sees another one's data.
Access control
Each member has a role — owner, admin, member or viewer — that limits what they can see and change. Your session stays in an encrypted cookie that the page's scripts cannot read. Single sign-on (SSO) is available on the Business plan and above.
Tools under control
Your organization sets, for each tool, whether agents may use it freely, only after a person approves, or never. An agent can only tighten that rule, never loosen it.
Guardrails
Personal data (emails, phone numbers, IBANs, card numbers, social security numbers) can be masked or rejected in questions and answers, and terms can be blocked. Rules set by the organization apply to every agent.
Masked traces
Conversation traces help you understand what an agent did, with tool arguments and queries masked. Only owners and admins can read them, and they are deleted at the end of your plan's retention period.
Verified files
The type of a file sent to an agent is read from its content, never from what the sender declared, and that is the type it is served as.
Abuse protection
Sign-up, verification codes, password resets, invitations and incoming webhooks are rate-limited, so they cannot be used to guess a code or flood the service.
Which personal data we process, why and with which subprocessors is detailed in our privacy policy.
Report a vulnerability
Found a security issue? Write to contact@squadico.com. We read every report and answer quickly.