A CMS built for enterprise teams
Agility gives your organization one place to manage content, with the flexibility to use the technology that works best for your business. Content teams can create and publish without waiting on developers. Developers can build with the tools they know. Your CMS connects with the systems you already use
AI
AI your security team can say yes to
Let your team work in Claude, ChatGPT or Microsoft 365 Copilot without handing AI the keys. Every request runs as a named person, with that person's permissions, checked on every call. AI changes save to Staging, your approval steps still apply, and every change is recorded in version history. We don't train AI models on your content.
How AI stays inside your rules
Every request runs as a real person
Each person signs in with their own Agility account. No shared API keys, and no service account with access to everything.
AI can't do more than the person using it
Permissions are checked on every call at the API, not in the AI tool. If someone can only read, so can their AI.
Nothing goes live on its own
AI saves land in Staging. Publishing needs the Publish permission, and your approval workflows still apply.
You set how much it can do
Let AI draft for a person to review, route its work to an approver, or publish low-risk content on its own. You decide, per content type.
Every change is on the record
Changes made through AI are saved in version history under the person who made them, and you can roll back any of them.
Your content isn't training data
We don't use your content to train AI models. You choose which AI tools your team connects.
See AI with AgilitySecurity
Security your review team can sign off on
Everything here is in place today, not on a roadmap. Our controls are independently audited, and we'll share the evidence with you under NDA.
SOC 2 Type II
Our controls are independently audited against the AICPA Trust Services Criteria. Ask, and we'll share the report under NDA.
GovRAMP registered
We're registered with GovRAMP, the program public sector teams use to vet a cloud vendor's security.
Encrypted in transit and at rest
TLS 1.2 or higher on every connection, AES-256 on everything stored, and keys held in a managed key vault.
Your data stays where you put it
We run on Microsoft Azure. Pick your data region, US, Canada, Europe or Australia, and your content stays at rest there.
Backups and disaster recovery, tested
Automatic backups, automatic failover to a secondary region, and recovery tested at least once a year. Your live site keeps serving published content throughout.
99.95% uptime SLA, in writing
It's in your contract, not just on our website. Check every system's live status any time, and subscribe to incident alerts.
See Live StatusSingle sign-on
Sign in through the identity provider you already run
Connect Agility to your identity provider and make it the only way in. Your MFA, device and Conditional Access policies apply to every sign-in. SSO is included in Enterprise and available as a paid add-on on select plans.
Works with your identity provider
Microsoft Entra ID, Okta, Google Workspace, OneLogin, PingFederate, or any provider that supports SAML 2.0 or OpenID Connect.
Read the SSO DocsMake SSO the only way in
We switch off passwords and social logins for your organization, so nobody can go around your identity provider.
Your policies on every sign-in
MFA, compliant devices and Conditional Access are enforced by your identity provider, exactly like every other app you run.
Set up with you, not handed off
We create the connection, test it with your IT team, and switch it on when you're ready. No ticket queue.
Not on SSO? Enforce MFA anyway
Require multi-factor authentication for every user in your organization, across every instance.
Offboarding that actually closes the door
Disable someone in your identity provider and they can't sign in. Remove them from Agility and their API tokens stop working too.
Can a company this small handle an organization like ours?
Twenty people can still run large, regulated accounts, because we already do. If we can't meet your requirements, we won't take you on
Governance
Governance that holds up as you grow
Roles, teams, approvals and version history work together, so your permissions don't fall apart when you add a brand, a region or an agency.
Permissions that match how your team works
Nine built-in roles cover most teams. Need something specific? Build custom roles, and lock down access by page or by content item.
See Roles & PermissionsTeams for agencies and regions
Give an agency, a regional team or a contractor access to the right instances in one step, and remove them all at once when the work's done.
Every brand, site and region in one place
Run several sites from one instance, or give each brand its own instance with its own users, workflows and data region.
See Developer FeaturesApprovals before anything goes live
Require sign-off on any page or content list. Reviewers approve or send it back with notes, and batch publishing never skips the queue.
Every market, one place
Publish in as many languages as you need, translate as you copy with DeepL, and manage every market from the same screen.
Know who changed what, and when
Every change to content and pages is saved as a version: what changed, who made it, when, and its workflow state. Versions are kept indefinitely, and you can restore any of them.
The platform provides a consistent user experience for our content team to easily make updates to movie/theatre details, content and metadata, news, blogs, contests and more.
Jeffrey Kent
Former Chief Technology Officer
Questions people ask about running Agility at scale
The things a security or IT lead usually needs answered before signing off.
Will this pass our security review?
Most likely, yes. SOC 2 Type II, GovRAMP registration, encryption in transit and at rest, Azure hosting with a 99.95% uptime SLA, and full version history are already in place, not on a roadmap. Send us your questionnaire and we'll tell you straight where we stand.
Can I see your SOC 2 report?
Yes. Our Trust Center, powered by Vanta, holds our SOC 2 report and security documentation. Just ask and we'll give you access.
Do you support single sign-on?
Yes. Connect Microsoft Entra ID, Okta, Google Workspace, OneLogin, PingFederate or any SAML 2.0 or OpenID Connect provider, and make it the only way to sign in. SSO is included in Enterprise and available as a paid add-on on select plans.
Can we enforce multi-factor authentication?
Yes. With SSO, your identity provider enforces MFA under your own policies. Without SSO, we enforce MFA for every user in your organization, across every instance.
Can we restrict access to our network?
Do it through your identity provider. Make SSO the only way in, and your network rules, like Microsoft Entra Conditional Access, decide who can sign in, from where, and on which devices.
Can users be provisioned automatically from our identity provider?
Not yet. Today you add users in Agility, or in bulk through our Management API, and assign their roles there. Automatic provisioning with SCIM is on our public roadmap.
How do we remove someone's access when they leave?
Disable them in your identity provider and they can't sign in again. Remove them from your Agility instances and any API tokens they created stop working on their next request.
Can we control exactly who can touch what?
Yes. Nine built-in roles cover most teams out of the box. If you need more control, add granular permissions and approval workflows.
Can an agency work in our CMS without seeing everything?
Yes. Put the agency in a team, give that team a role on only the instances it needs, and narrow it further by page or content list. When the project ends, remove the team and everyone's access goes with it.
Can we manage multiple sites, brands, or regions from one place?
Yes. A single Agility instance can run multiple websites, brands, and regions, each with its own permissions
Where is my data hosted?
On Microsoft Azure, in the data region you choose: US, Canada, Europe or Australia. Your content stays at rest in that region, and disaster recovery replication stays inside the same geography, so Canadian data stays in Canada. It's all backed by a 99.95% uptime SLA.
How is our data encrypted?
Every connection uses TLS 1.2 or higher, and everything stored is encrypted at rest with AES-256. Keys and secrets live in a managed key vault on Azure.
What happens to our website if your platform goes down?
Your website keeps running. Published content is served from the edge, so visitors keep seeing your site while we fail over to a secondary region. Editing might pause for a moment. Your live site doesn't.
Do you use AI on my data?
We don't use your content to train AI models. AI features run through our MCP server with your own tools, or through opt-in integrations such as DeepL translation.
Will you fill out our security questionnaire?
Gladly. Most answers are already in our documentation, and we'll share our SOC 2 report, disaster recovery details and policies under NDA. You'll be working with people who know the platform, not a form-filling bot.
What happens if you can't meet our requirements?
You'll hear about it before you sign. The Perfect Fit Guarantee means we don't take on an account we can't properly support
Fast-track your security review
Send us your questionnaire. We'll answer it, share our SOC 2 report and security documentation through our Trust Center, and get you on a call with our team. No ticket queue, no runaround.