What is your developer-dependent CMS actually costing you? Calculate your costs and get a full report
Security and Compliance
The Agility Shared Responsibility Model
What Agility secures, what your team secures, and what is shared, in one place: infrastructure, data and recovery, delivery, identity and access, integrations, and logging.
Agility CMS is a hosted service. Agility runs the platform on Microsoft Azure: the Content Manager, the content and management APIs, the asset CDN and the data behind them. Your team, often with an implementation partner, builds and runs everything on top: the website or app, its hosting and CDN, the integrations, and the way people and systems are given access.
Security, continuity and compliance therefore depend on both sides. This page brings together the shared-responsibility tables from across the Owners & Admins documentation, so a security reviewer or platform owner can see the whole split at once. Each row links to the article it comes from, which has the full detail.
The short version
- Agility secures the platform: Azure infrastructure, the Content Manager, the content and management APIs, the platform CDN, encryption in transit and at rest, platform backups and recovery, and the controls you use to manage access.
- Your team secures what it builds and how it uses the platform: the front end and its hosting, your CDN and its rules, the keys and tokens you are given, your webhook endpoints and integrations, and who has access to your instances.
- Some things are shared: Agility provides a control (roles, SSO, MFA, signed webhooks, version history) and your team decides how to configure and use it.
In the tables below, "Your team" means the customer and any implementation partner working for them.
Infrastructure and platform
| Area | Agility | Your team | Source |
|---|---|---|---|
| Physical and network infrastructure | Runs on Microsoft Azure data centres and network controls. | Nothing to operate. | Hosting, Security & Compliance |
| Platform and content APIs | Patching, hardening, encryption in transit (TLS 1.2 minimum) and at rest (AES-256), and a managed key store for keys and secrets. | Nothing to operate. Customer-managed keys (BYOK) are not available at this time. | Hosting, Security & Compliance |
| Platform attestations | Maintains Agility's own attestation. Get the current reports from the Trust Center or your account team. | Reviews the reports and maps them to its own compliance program. | Hosting, Security & Compliance |
| Agility's internal security program | Operates an information security program, including MFA for administrative and remote access to its systems, incident response, secure development and periodic internal and external audits. Details are shared under NDA. | Requests the details it needs through a security review. See the Security Review Pack. | Hosting, Security & Compliance |
Data location, backups and recovery
| Area | Agility | Your team | Source |
|---|---|---|---|
| Storage region | Provisions and operates the instance in the selected Azure region and keeps its data at rest in that region. | Selects the right region when the instance is provisioned. Moving later needs planning time and a statement of work. | Data Residency & Data Regions |
| Delivery region | Operates the platform edge, which caches published content worldwide. It cannot be geographically restricted at this time. | Decides whether delivery residency (not only storage residency) is required, and enforces any geographic restriction in its own front end and CDN. | Data Residency & Data Regions |
| Platform backups and recovery | Automated backups, and recovery of the management and API layer to a secondary region. Recovery objectives are defined and available on request. | Aligns its own continuity plan to Agility's stated objectives. | Disaster Recovery & Business Continuity |
| Content-level recovery | Version history on content and pages, plus platform restore. | Uses version history to recover from editorial mistakes, and defines its own internal process for requesting a restore. | Disaster Recovery & Business Continuity |
| Front-end continuity | Nothing to operate. | Designs the website or app for resilience: static generation, hosting, its own CDN failover. | Disaster Recovery & Business Continuity |
| Your own copy of your content | Provides the CLI and APIs to export content and structure. | Keeps its own export if its policies need one. | Getting Your Content Out: Data Portability and Exit |
For what happens to an instance's data after the instance is deleted or a subscription ends, see the Agility Customer Agreement and ask your account team or support@agilitycms.com.
Delivery and availability
| Area | Agility | Your team | Source |
|---|---|---|---|
| Platform CDN for content APIs and assets | Delivers the content APIs and the asset CDN through Fastly's global edge network, and invalidates cached content at the edge when you publish. | Requests appropriate image sizes and formats. | Content Delivery & CDN Architecture |
| Front-end application and hosting | Nothing to operate. | Secures the website or app, its hosting, its HTTP headers and its own CDN (cache lifetimes, invalidation, WAF, geo rules). | Hosting, Security & Compliance |
| Cache invalidation end to end | Provides webhooks and revalidation triggers. | Wires revalidation into the front end and its CDN. | Content Delivery & CDN Architecture |
| Availability | Meets the availability targets in your agreement with Agility, and publishes status at status.agilitycms.com. | Implements static generation and correct caching so published content keeps serving, monitors against its own requirements, and owns the uptime of its own site. | SLA & Uptime |
| Maintenance | Schedules maintenance and notifies customers. | Plans editorial and release activity around notified windows. | SLA & Uptime |
Identity and access
| Area | Agility | Your team | Source |
|---|---|---|---|
| How people sign in | Provides email and password sign-in with MFA, Google, Microsoft and GitHub sign-in, and Enterprise single sign-on. Enforcing MFA and restricting sign-in methods need a Pro or Enterprise plan; Enterprise SSO needs an Enterprise plan. These settings are changed by contacting support. | Chooses which sign-in methods are allowed, enforces MFA (in Agility, or at its identity provider when using SSO), and turns off the other sign-in methods so MFA cannot be bypassed. | User Authentication, Multi-Factor Authentication |
| Roles and permissions | Provides built-in roles, Custom Roles, item-level permissions, Teams and approval workflows, and checks permissions on every Management API call. SSO authenticates the user; roles are assigned in Agility. | Configures least-privilege roles and manages joiners, movers and leavers. | Hosting, Security & Compliance, Roles and Permissions Matrix |
| API keys and secrets | Issues keys and stores them securely server-side. | Stores Fetch, Preview and Management credentials securely, keeps Preview and Management credentials out of client-side code, and rotates them when staff change. | Hosting, Security & Compliance |
| Personal Access Tokens | Tokens act as the user who created them, inherit that user's permissions, last at most two years, and can be revoked. The secret is shown once. Removing a user from an instance stops their tokens working there. | Creates tokens under the right user, sets an expiry date, stores them in a secrets manager, rotates them and revokes unused ones. | Personal Access Tokens, User Authentication |
| AI assistants (Agility CMS MCP Server) | Each person signs in with their own Agility account over OAuth, and the Management API checks that user's permissions on every call. Saves land in Staging. | Decides which AI clients are allowed, which roles can publish or delete, and how much autonomy AI gets for each kind of content. Reviews the data handling terms of the AI tools it approves. | Governing AI Access to Agility CMS, What Happens to Your Data When You Use AI |
Integrations, webhooks and custom code
| Area | Agility | Your team | Source |
|---|---|---|---|
| Webhooks | Sends webhooks for content and page saves, publishes, unpublishes, deletes and workflow actions. Signs deliveries when secure delivery is turned on, supports rolling the signing secret, and keeps delivery history for 90 days. | Turns on secure delivery, verifies signatures, secures the endpoint, and stores the signing secret. | Verifying Signed Webhooks, Webhook Events and Payload Reference |
| Marketplace apps | Apps installed into the Content Manager use the signed-in user's session, and that user's roles still apply. | Administrators decide which apps to install. | Security Review Guide |
| Custom code and integrations | Provides the APIs, SDKs and webhooks. | Secures custom scripts, webhook endpoints, apps and integration credentials. | Hosting, Security & Compliance |
For questions about the security of a specific Marketplace app, contact support@agilitycms.com.
Logging, monitoring and incidents
| Area | Agility | Your team | Source |
|---|---|---|---|
| Content audit trail | Captures version history (who, what, when and workflow state) and the Recent Changes report. Versions are immutable and retained indefinitely. | Reviews history as part of governance and maps it to its own retention requirements. | Audit Trail, Logging & SIEM Integration |
| Administrative and security events | Content activity is recorded through version history and Recent Changes. A customer-facing administrative or security event log (users added or removed, role changes, token creation) is not available today. | Captures sign-in events in its identity provider, and application and security events at its hosting layer. | Audit Trail, Logging & SIEM Integration |
| Forwarding events to a SIEM | Provides webhooks. There is no native SIEM connector. | Builds the webhook handler and the SIEM pipeline, retention and alerting. | Audit Trail, Logging & SIEM Integration |
| Live site observability | Provides the content APIs being called. | Uses its hosting platform's observability to trace requests and API dependencies. | Audit Trail, Logging & SIEM Integration |
| Incident response | Detects, declares and communicates platform incidents, and notifies affected customers through its support channels. | Monitors its own application and defines its own internal communications and runbook. | Disaster Recovery & Business Continuity |
| Reporting a vulnerability or incident | Reviews reports sent to support@agilitycms.com, as described on the Agility security page. | Reports suspected vulnerabilities or incidents to support@agilitycms.com, and tests only systems it owns or has permission to test. | Agility security page |
Using this page in a review
- For how sign-in, permissions, network access and logging work, read the Security Review Guide.
- For a vendor questionnaire, start with the Security Review Pack, which maps common questionnaire areas to the articles that answer them.
- For the tasks your team owns at launch, use the Admin Go-Live Checklist.
- For who builds what in a headless project beyond security, see What Your Team Builds vs What Agility Provides.
Related articles
On this page