[ security ]
Security at Algomo
How the Algomo agent reaches your data, how that data is protected, and who processes it. Written from the product's code, and updated when the code changes.
How the agent reads your site
Algomo finds the data connections your own pages already use. When a visitor asks something that needs live data, such as an order status, the request runs in that visitor's browser, inside their own signed-in session, with their own permissions. The agent can only see what that visitor could already see on your site.
The response passes through Algomo's servers so the agent can write the answer, and the conversation is kept in your workspace so you can review it. Systems that only your staff can reach are not touched this way. Those we connect with you, with credentials you choose to give.
A pilot therefore needs no access to your back-end systems and no project from your IT team.
Where your data lives
Algomo's application servers, database and file storage are hosted in the EU. The AI model providers listed under Subprocessors may process conversation content outside the EU to generate an answer.
Algomo keeps personal data only as long as it is needed, and never longer than five years, as set out in the privacy policy. To have a workspace's conversations deleted, email privacy@algomo.com.
Encryption and credentials
The website and the dashboard are served over HTTPS. Plain HTTP requests are redirected.
Tokens and API keys you give Algomo to connect an outside service, such as Google Calendar or Slack, are encrypted with AES-256-GCM before they are stored. Disconnecting a Google account deletes its tokens and revokes them with Google. Algomo's own API keys are stored only as keyed hashes, so the original key cannot be read back from the database.
When you manage Algomo from an AI assistant, connection details come back redacted. The assistant can see that a connection exists, not the secret behind it.
Access control
Dashboard sign-in runs on Clerk, and every request is scoped to your organisation. Access from AI assistants over MCP uses OAuth 2.1 with PKCE: access tokens last one hour, and each refresh token works once.
Algomo support staff can open a customer workspace to help with a problem. Any change made that way is recorded under the staff member's name.
Change history
Changes to an agent's setup are staged with a diff before they go live. Every saved change becomes a version that records who made it, and an earlier version can be restored.
AI models
By default, conversations are processed by OpenAI. Anthropic, Google and Mistral AI models, reached through OpenRouter, process them only if you or your organisation select one of those models. Each provider processes content to generate the requested response, under commercial API terms that prohibit using it to train their models.
Subprocessors
The services that process customer or visitor data on Algomo's behalf, as of 16 October 2026.
| Service | What it does for Algomo |
|---|---|
| Railway | Hosts the application and API servers |
| Neon | Hosts the Postgres database |
| Amazon Web Services | File storage, the content delivery network for the widget, and email sending |
| Clerk | Dashboard sign-in |
| OpenAI | Default AI model provider |
| OpenRouter | Routes requests to Anthropic, Google and Mistral AI models when selected |
| Stripe | Payments |
| PostHog | Product analytics |
| GlitchTip | Error reports from the chat widget |
| Slack, Google, Microsoft | Notifications and calendar features, when you connect them |
| Apollo, Exa, HappierLeads, Vector | Lead enrichment and company identification for sales agents |
| Infisical | Storage of Algomo's own operational secrets |
Compliance
Algomo Limited processes personal data under the UK GDPR and the EU GDPR. A data processing agreement is available on request from privacy@algomo.com.
Algomo has not completed a SOC 2 audit. Ask for our answers to your security questionnaire and we will send them.
Report a security issue
Email privacy@algomo.com with what you found and how to reproduce it.
[ next step ]