Authentication: bcrypt password hashing, JWT sessions, TOTP multi-factor authentication (mandatory for admin roles), encrypted recovery codes, and account lockout after repeated failed sign-in attempts.
Sessions: Sessions are tracked per device with the ability to view and revoke individual sessions, or sign out everywhere at once. Sessions are automatically revoked on password reset or other sensitive security events.
Step-up verification: Sensitive actions — billing changes, data exports, account deletion, role changes — require re-verifying with MFA even within an active session.
Data: PostgreSQL with TLS in transit, tenant isolation enforced at the query level, encrypted MFA secrets (AES-256-GCM), and multi-tenant data separated so no company can see another company's data.
Rate limiting: Login, registration, password reset, and MFA endpoints are all rate-limited per IP, with generic error messages that avoid confirming whether an email address has an account.
Payments: All card data handled by Stripe (PCI DSS Level 1). No card numbers are stored, processed, or transmitted through AGM Cloud infrastructure. Webhook signatures are verified server-side.
AI features: AI-assisted tools (quote pricing, contract/email drafting, marketing copy, chat assistant) always produce a draft for a person to review — nothing is sent, signed, or posted automatically.
Access: Role-based access control, platform and company-level audit logging (actor, action, target, timestamp), and webhook signature verification.
Status: AGM Cloud is currently in private beta. We are not yet certified under any formal compliance framework (e.g. SOC 2), though our controls are built in alignment with common frameworks as we work toward certification post-launch.
Reporting: security@agmcloud.cc for vulnerability reports.
© 2026 Auvix Global Movers LLC. All rights reserved. AGM Cloud is a SaaS product owned and operated by Auvix Global Movers LLC.