What is your developer-dependent CMS actually costing you? Calculate your costs and get a full report
What is your developer-dependent CMS actually costing you? Calculate your costs and get a full report
Security and Compliance
Where each common security questionnaire area is already answered in Agility's documentation and security pages, what is shared on request, and which questions to raise early.
If you are completing a vendor security questionnaire about Agility CMS, such as a SIG, a CAIQ or your organization's own form, this page tells you where each common area is already answered. Every answer it points to is in a published Agility article or on an Agility security page, so you can quote the source directly.
Some details are not published and are shared on request, often under NDA. Those are listed below so you can ask for them early instead of finding the gap at the end of the review.
For a single summary of how sign-in, permissions, network access and logging work, read the Security Review Guide first.
| Resource | What it gives you |
|---|---|
| Agility Trust Center | Agility's compliance reports, security questionnaires and policy documentation. |
| Agility security page | An overview of security at Agility, with links to the Trust Center, system status and vulnerability reporting. |
| Security Review Guide | Every way into Agility, sign-in and permissions, network restrictions, audit and logging, and removing a user's access. |
| Hosting, Security & Compliance | Hosting, encryption, key management, the security program, identity and access controls, and which certifications are Agility's own versus the Azure platform's. |
| The Agility Shared Responsibility Model | What Agility secures, what your team secures, and what is shared, in one set of tables. |
| status.agilitycms.com | Live platform status and incident history, with subscriptions to incident notifications. |
For certifications and attestations, including report dates and audit periods, get the current reports from the Trust Center or your account team, and quote those in your questionnaire.
| Questionnaire area | Where the answer is | What you will find |
|---|---|---|
| Security governance and policies | Hosting, Security & Compliance: Security program & governance | The policy domains Agility's information security program covers, and that policy and control details are shared under NDA. |
| Compliance and attestations | Trust Center, Hosting, Security & Compliance: Certifications and compliance | Agility's own attestation, how to request the report, and which certifications belong to Microsoft Azure. |
| Hosting and infrastructure | Hosting, Security & Compliance, Content Delivery & CDN Architecture | Hosting on Microsoft Azure, and the two CDN layers: Agility's platform CDN, which is Fastly, and your own front-end CDN. |
| Data location and residency | Data Residency & Data Regions | The available regions, what is stored in the selected region, and why edge delivery is a separate, global layer. |
| Encryption and key management | Hosting, Security & Compliance: Encryption and Key management | Standards in transit and at rest, the managed key store, and BYOK availability. |
| Backup, disaster recovery and business continuity | Disaster Recovery & Business Continuity | The backup model, multi-region recovery, failover, DR testing frequency, and what keeps serving during an incident. |
| Availability and SLA | SLA & Uptime | The difference between the delivery and management service levels, maintenance, service credits and status monitoring. |
| Authentication | User Authentication, Enterprise Single Sign-On with Agility, SAML Identity Provider Integration, Authenticate with Microsoft or Azure AD/Entra, Multi-Factor Authentication, Password Management | Supported sign-in methods and identity providers, plan requirements, MFA enforcement and enrolment, and password reset. |
| Authorization and least privilege | User Permissions, Roles and Permissions Matrix, Custom Roles, Item-level Permissions, Teams | Built-in roles, base permissions, Custom Roles, item-level security and team-based access. |
| Network access | Security Review Guide: Network restrictions | What network restrictions are and are not available, and how to apply network policy through your identity provider. |
| User provisioning and deprovisioning | User Lifecycle at Scale, User Access | What is supported for adding, changing and removing access, and how to review it. |
| API and credential management | Personal Access Tokens, API Key Management | Token lifetime, scope and revocation; API key types, storage and regeneration. |
| Logging and monitoring | Audit Trail, Logging & SIEM Integration, Accessing Reports | Version history, Recent Changes, User Activity, what is not logged for customers today, and how to forward events to a SIEM. |
| Integrations and webhooks | Verifying Signed Webhooks, Webhook Events and Payload Reference | Signed deliveries, secret rotation, retries, delivery history and its retention. |
| AI and data handling | What Happens to Your Data When You Use AI, Governing AI Access to Agility CMS | How the Agility CMS MCP Server authenticates and is governed, and what data leaves Agility when people use AI. |
| Security testing | Agility security page | Third-party penetration testing, and the option for enterprise customers to collaborate on custom penetration testing. |
| Vulnerability disclosure | Agility security page | Where to report a vulnerability and what Agility asks of researchers. |
| Incident response and notification | Hosting, Security & Compliance, Disaster Recovery & Business Continuity, Agility security page | That a defined incident process exists, how affected customers are notified, and where to report an incident. |
| Privacy and GDPR | Agility GDPR page, Privacy Policy | Agility's data protection commitments and how to make a data request. |
| Contract terms | Agility Customer Agreement | The agreement that governs the service. SLA figures and service credits are part of each customer's agreement. |
| Your own responsibilities | The Agility Shared Responsibility Model, Admin Go-Live Checklist | What your team must secure and configure, so your answers cover both sides. |
The published articles say these details are available on request, including under NDA as part of a security review or RFP. Ask through Contact Agility:
These points come straight from the articles above. They are the ones most worth checking before you submit:
For questionnaire topics not covered in the documentation, such as subprocessors, a data processing agreement, data retention and deletion after a subscription ends, penetration test summaries or personnel security, contact your account team or support@agilitycms.com. Record the answer and its date in your questionnaire.
