Small in size. Just as secure as the biggest.
Don't let our size fool you. We're SOC 2 Type II compliant, and banks, government organizations, and other highly regulated industries trust us with their content. Security is a big deal around here, and our Security Committee has oversight across every department to keep it that way.
We do everything the big players do
Our controls are independently audited by third parties, so you don't have to take our word for it.
SOC 2 Type II
Independently audited controls covering security, availability, and confidentiality.
GovRAMP registration
Meets the requirements public sector organizations use when handling government data.
Enterprise single sign-on with Auth0
Sign-in runs through Auth0, an enterprise-grade identity layer, with SSO and multi-factor authentication so IT manages access the same way it manages every other system.
Deployed on Microsoft Azure
We run on Microsoft Azure infrastructure, backed by a 99.95% uptime SLA that's written into the contract, not just a marketing number.
Public vulnerability reporting
Researchers get a clear channel to report an issue, and we have a documented path from report to fix.
Report a VulnerabilityLive system status
No secrets here. Check the status of all our systems, deployed around the world, any time you want.
Security doesn't stop at our infrastructure. It's built into the product.
Teams, custom roles, multi-factor authentication, and single sign-on are all part of the platform, so the right people have the right access and nobody else does.
Control access globally, by page, or by content item
Set permissions across the whole instance, lock down a single page, or protect one piece of content. You decide how granular to go, and you can change it as your team grows.
Highly regulated industries put their trust in us
For decades we've helped organizations, from banks to government, build highly scalable, seriously secure digital experiences. They take security as seriously as you should, and they chose us. Real users back it up: G2 rates Agility a Leader in Headless CMS, and Best Meets Requirements, Easiest to Do Business With, and Easiest Admin for enterprise.
How a company our size handles enterprise security
See for yourself. SOC 2 Type II, GovRAMP registration, third-party audits, enterprise SSO, Azure hosting, and live system status. We're small, but we do everything the big players do, and then we actually pick up the phone.
The questions you're actually thinking
Have you ever been hacked?
No. In more than 20 years, we've never had a breach of customer data. That's not luck. It's SOC 2 Type II controls, third-party audits, and a Security Committee that answers for it.
You're a small company. What happens if something goes wrong?
We take it very seriously. We have a documented incident response process, our controls are audited by third parties, and you'll hear from a real person who knows your account, not a vague status-page update days later.
Who at Agility can see my content?
Only our support and engineering teams, and only when they need to in order to help you. Inside your instance, you decide who sees what with roles, teams, and page- or content-level permissions.
Do you use AI on my data?
We don't use your content to train AI models. AI features run through our MCP server with your own tools, or through opt-in integrations such as DeepL translation.
Can I see your SOC 2 report?
Yes. Our Trust Center, powered by Vanta, holds our SOC 2 report and security documentation. Just ask and we'll give you access.
Can Agility meet the requirements of a regulated industry?
Banks and government organizations already trust us. Tell us your industry's specific standard and we'll tell you straight whether our SOC 2 Type II and GovRAMP coverage meets it, or what we'd need to work through together.
Where is my data hosted?
On Microsoft Azure, in the data region you choose: US, Canada, Europe or Australia. Your content stays at rest in that region, and disaster recovery replication stays inside the same geography, so Canadian data stays in Canada. It's all backed by a 99.95% uptime SLA.
Do you support single sign-on?
Yes. Connect Microsoft Entra ID, Okta, Google Workspace, OneLogin, PingFederate or any SAML 2.0 or OpenID Connect provider, and make it the only way to sign in. SSO is included in Enterprise and available as a paid add-on on select plans.
Bring your security and compliance questions to us
The weirder your requirements, the more we want to talk. Let's look at your project together and make sure we're a great fit.