Founded in 2025
Amanah Agent AI is an AI-powered customer engagement platform that helps businesses automate customer interactions through WhatsApp, Voice AI, and Chat AI with enterprise-grade security.
We recognize the confidentiality, integrity and availability of information and data created, maintained and hosted by us are vital to the success of our customers and partners.
Security is at the core of everything we build. Our platform is designed with enterprise-grade security controls including multi-layer encryption, comprehensive audit logging, and strict access controls to protect your data and ensure compliance with global standards including GDPR, ISO 27001, SOC 2, and Indonesian UU PDP regulations.
Founded in 2025
|
|
Controls (43)
Here are the controls implemented at Amanah Agent AI to ensure compliance, as a part of our security program.
Product security (11)
Role Based Access Controls
Granular permission system with role assignments. Authorization checks enforced on all protected API endpoints. Users can only access resources they're explicitly authorized for.
Audit Logging
Comprehensive audit logging with 90-day retention and daily rotation. Tracks authentication events, data operations, security alerts, and compliance activities with correlation IDs for request tracing.
Data Security
Multi-layer data protection: AES-256 encryption at rest, TLS 1.3 in transit, AWS KMS key management, field-level encryption for PII, and secure hash functions for lookups.
Integrations
Secure third-party integrations with encrypted credentials stored in AWS Secrets Manager. API keys and tokens are never exposed in logs or error messages.
Team Management
Multi-tenant team management with user invitation, role assignment, and access revocation capabilities. Activity tracking per team member.
JWT Authentication
Secure token-based authentication with access tokens (30-min expiry) and refresh tokens (7-day expiry). Tokens are cryptographically signed using HS256 algorithm.
Multi-Factor Authentication (MFA)
TOTP-based two-factor authentication for enhanced account security. Users can enable MFA to require a time-based code in addition to password.
Account Lockout Protection
Automatic account lockout after 5 failed login attempts with 30-minute lockout duration. IP-based tracking prevents distributed brute-force attacks.
Device Trust & Fingerprinting
Unique device identification using browser, screen resolution, timezone, language, and platform attributes. Email alerts sent when new devices are detected.
Secure Session Management
Configurable session timeouts with secure token handling. Token blacklisting on logout prevents token reuse attacks.
Password Security
Passwords hashed using bcrypt with secure salt. Passwords are never stored in plaintext or reversible format.
Data security (11)
Access Monitoring
Real-time monitoring of all access attempts including login tracking, failed attempt detection, impossible travel detection, and new device alerts. IP-based tracking with automated lockout after suspicious activity.
Backups Enabled
Automated database backups with verification procedures. Backup integrity validation and documented restoration processes. Regular backup testing to ensure data recovery capability.
Encryption at Rest
All sensitive data encrypted using AES-256 encryption with Fernet symmetric encryption. Multi-version encryption keys managed via AWS KMS with seamless rotation support. Field-level encryption for PII.
Encryption in Transit
All data transmission secured with TLS 1.3 encryption. HSTS (HTTP Strict Transport Security) enforced with 1-year max-age to prevent downgrade attacks. Certificate validation on all external connections.
Physical Security
Infrastructure hosted on AWS with SOC 2 certified data centers. Physical access controls include biometric authentication, 24/7 security monitoring, and environmental controls. Data center locations comply with regional data residency requirements.
AES-256 Encryption at Rest
All sensitive data encrypted using industry-standard AES-256 encryption with Fernet symmetric encryption scheme.
TLS 1.3 Encryption in Transit
All data transmission encrypted with TLS 1.3. HSTS (HTTP Strict Transport Security) enforced with 1-year max-age.
AWS KMS Key Management
Enterprise key management using AWS Key Management Service for secure storage, rotation, and access control of encryption keys.
Multi-Version Encryption Keys
Versioned encryption keys with seamless rotation support. Old data automatically re-encrypted during access when keys are rotated.
Field-Level Encryption
Sensitive database fields (PII, credentials) encrypted individually. Secure hash lookups for email addresses without exposing plaintext.
Secure Data Deletion
Cryptographic erasure capabilities for data deletion requests. Data anonymization for analytics while preserving privacy.
Network security (7)
Data Loss Prevention
Comprehensive DLP controls including audit logging of all data access, data export tracking, consent management, and automated alerts on bulk data operations. GDPR-compliant data subject request handling with approval workflows.
Firewall
Multi-layer firewall protection using AWS Security Groups and application-level origin validation. Whitelist-based access control with strict CORS policies blocking unauthorized origins.
IDS/IPS
Intrusion detection system with real-time threat monitoring, SQL injection pattern detection, XSS attack prevention, and DDoS detection with automatic IP blocking. Severity-based alerting for security events.
Spoofing Protection
Anti-spoofing controls including strict origin validation, CSRF token verification, security headers (X-Frame-Options, X-Content-Type-Options), and request signing for API integrations.
Rate Limiting
Per-endpoint rate limits with exponential backoff. Subscription tier-based limits ranging from 500 to 50,000+ requests per day.
DDoS Protection
Real-time DDoS detection with automatic IP blocking. Distributed attack tracking via Redis for multi-instance protection.
Origin Validation (CORS)
Strict CORS policies with whitelist-based origin restriction. Requests from non-whitelisted origins blocked even with valid credentials.
App security (4)
Code Analysis
Static code analysis integrated into development workflow. Semgrep for security vulnerability detection and Gitleaks for secret scanning to prevent accidental credential commits. |
Credential Management
All sensitive credentials stored in AWS Secrets Manager including database passwords, API keys, encryption keys, and third-party service tokens. No credentials hardcoded in source code.
Software Development Life Cycle
Structured SDLC with version-controlled database migrations, documented change management processes, code review requirements, and controlled deployment procedures.
Vulnerability & Patch Management
Penetration testing tracking and vulnerability management. Third-party security assessments documented with remediation tracking and patch deployment procedures.
Endpoint security (2)
Threat Detection
Real-time threat detection including impossible travel detection (login from distant locations), brute-force attack detection with automatic account lockout, device fingerprinting for anomaly detection, and security event monitoring with severity-based alerting.
Disk Encryption
Storage volumes encrypted using AWS EBS encryption with AES-256. Encryption keys managed through AWS KMS with automatic key rotation.
Corporate security (8)
Incident Response
Documented incident tracking and management procedures. Security event correlation with request tracing for investigation and root cause analysis. Automated escalation based on severity levels.
Employee Training
Security awareness training program tracked and managed. Training completion monitoring with compliance reporting for security best practices and data protection.
Internal Assessments
Regular internal security assessments and penetration testing tracking. Vulnerability documentation with remediation timelines and verification procedures.
Security Alerts
Multi-channel security alerts via Slack webhooks, email notifications, and custom SIEM webhook integration. Automated alerts for brute force attacks, repeated account lockouts, impossible travel detection, and high-severity security events.
Audit Logging
Comprehensive audit logging with 90-day retention and daily log rotation with gzip compression. Tracks authentication events, authorization decisions, data operations, and security alerts with correlation IDs for request tracing.
Security Event Monitoring
Real-time security event logging with threat level assessment (NONE, LOW, MEDIUM, HIGH, CRITICAL). Pattern detection for SQL injection, XSS attacks, and other malicious activity with automated response.
Change Management
Documented change control processes for all system modifications. Version-controlled database migrations, code review requirements, and approval workflows before production deployment.
Access Control Policy
Role-based access control with granular permissions. Authorization checks enforced on all protected endpoints. Principle of least privilege applied to user and service accounts.
