# Hosting, Security & Compliance

> Source: https://agilitycms.com/docs/owners-admins/hosting-security-and-compliance

Agility CMS is a SaaS platform hosted on Microsoft Azure, using Azure's globally compliant infrastructure as its backbone. Content data is encrypted in transit (TLS) and at rest (AES-256), with cryptographic keys held in a secure managed key-management service. Agility maintains SOC 2 Type II compliance, and the underlying Azure platform carries broad certifications including ISO 27001, ISO 27018, and CSA STAR. Security is delivered under a **shared-responsibility model**: Agility secures the platform, infrastructure, and content APIs, while the implementation partner and customer secure their own front-end application, deployment pipeline, secrets, and end-user access.

![Layered security stack with a shared-responsibility trust boundary: the customer owns end users, their front-end and CDN; Agility secures the APIs, platform services, encrypted data stores, managed key vault, and certified cloud foundation.](https://cdn.aglty.io/agility-cms-docs/images/owners-admins/diagram-trust-boundary.svg)

## Hosting and infrastructure

Agility runs on **Microsoft Azure**, which provides the compute, storage, and network backbone for content storage, media/asset delivery, and key management. Instances are provisioned into one of five regions (see *Data Residency & Data Regions*). Building on Azure means Agility inherits Azure's physical security, network controls, and the broadest cloud-compliance coverage in the industry.

## Encryption

| Layer | Standard | Notes |
| --- | --- | --- |
| In transit | TLS 1.2 minimum (1.3 supported) | All API and management traffic served over HTTPS/TLS; **TLS 1.2 is the enforced minimum**. |
| At rest | AES-256 | Provided by the Azure platform; all stored data is encrypted by default. |
| Secrets & keys | Managed key-management service | Keys and secrets handled by a secure managed store; industry-standard hashing for credentials. |

## Key management

Cryptographic keys and application secrets are held in a secure, managed key-management service on Azure. At-rest encryption keys are managed within the Azure platform. **Customer-managed keys (BYOK) are not available at this time.**

## Certifications and compliance

- **Agility CMS** holds **SOC 2 Type II** (reported under the AICPA Trust Services Criteria), with the current reporting period beginning August 31, 2025. The SOC 2 report is available to prospects under NDA on request.
- The **underlying Microsoft Azure platform** carries a broad catalogue of certifications — including SOC 1/2/3, ISO 27001, ISO 27018, and CSA STAR — inherited as part of building on Azure.

This distinction matters in an RFP: SOC 2 Type II is **Agility's own** attestation, while the wider ISO/CSA certifications are **Azure platform** certifications that Agility builds on.

## Security program & governance

Agility operates a formal information-security program. A governing **Information Security Policy** sits over a comprehensive set of supporting policies covering the standard control domains expected of an enterprise vendor, including:

- Access control and asset management
- Data management and classification
- Cryptography
- Operations and physical security
- Secure development lifecycle
- Incident response
- Risk management
- Third-party / vendor management
- Business continuity and disaster recovery

In practice this means Agility enforces **multi-factor authentication (MFA) for administrative and remote access** to its systems, maintains a defined **security-incident reporting and response** process, classifies and protects data according to its sensitivity, builds security into its **development lifecycle**, and **reviews its policies and verifies compliance through periodic internal and external audits**. Detailed control specifics are confidential and shared under NDA as part of a security review rather than published.

The substance of individual policies and control implementations is confidential; for a security questionnaire or to review specifics under NDA, [contact Agility](https://agilitycms.com/contact-agility-cms).

## Identity, access, and operational controls

Agility supports enterprise authentication and role-based access:

- **Single sign-on (SSO)** via SAML and providers such as Microsoft Entra, through Agility's identity provider.
- **MFA** can be enabled for enterprise teams that sign in with username/password.
- **Fine-grained roles and permissions** for least-privilege access — note that **user roles are still provisioned within Agility** (SSO authenticates the user; role assignment happens in Agility).
- **Environment separation** between staging and production content states.
- **Version history / activity tracking** on content and pages (who changed what, when — see *Audit Trail, Logging & SIEM Integration*).

## Shared responsibilities

Security follows a cloud shared-responsibility split. Agility (with Azure beneath it) secures the platform; the implementation partner and customer secure what they build and operate on top.

| Layer | Agility (and Azure) | Implementation partner / customer |
| --- | --- | --- |
| Physical & network infrastructure | ✅ Azure data centres, network controls | — |
| Platform & content APIs | ✅ Patching, hardening, encryption at rest/in transit, key vault | — |
| Platform certifications (SOC 2, etc.) | ✅ Maintains Agility attestation | Reviews reports; maps to its own compliance program |
| API keys & secrets | ✅ Issues keys; secure storage server-side | ✅ Stores Fetch/Preview/Management keys securely; never exposes Management/Preview keys client-side; rotates on staff change |
| Front-end application & hosting | — | ✅ Secures the website/app, its hosting, headers, and its own CDN |
| User & role administration | ✅ Provides RBAC, SSO, workflows | ✅ Configures roles/least-privilege, manages joiners/movers/leavers, enforces MFA at the IdP |
| Custom code / integrations | ✅ Provides APIs/SDKs/webhooks | ✅ Secures custom scripts, webhook endpoints, and integration credentials |