01 / SECURITY AND OVERSIGHTPermissions that follow responsibility
Access design starts by identifying roles and the actions they need to perform. Reading a record is not the same as modifying it; preparing a proposal is not the same as approving it. The permission matrix should reflect those differences and account for the capabilities of connected systems.
- Access limited to the data and actions required by the process.
- Owners responsible for authorizing, reviewing and revoking permissions.
- An explicit distinction between automatic actions and decisions approved by a person.
02 / SECURITY AND OVERSIGHTInformation with a defined purpose
Before connecting a source, we identify the data the use case requires, where it will be processed and who will administer it. The selection of providers, models, environments and retention policies belongs in the technical scope. Your organization’s restrictions must be reviewed before introducing sensitive or regulated information.
03 / SECURITY AND OVERSIGHTBoundaries for consequential actions
An agent needs a clear path when information is missing, a request exceeds its scope or another system’s response is uncertain. Confirmation and escalation points are designed around the risk of each task. Contract changes, eligibility decisions and financial movements require specific review; their appearance in a website scenario does not authorize them.
04 / SECURITY AND OVERSIGHTAgreed traceability and evaluation
Reviewing a process requires knowing which request arrived, which sources were consulted and which action was attempted. Logging scope, access to evidence, retention periods and error review are agreed per project. Evaluation should include misuse, unexpected instructions and answers unsupported by sufficient information.
05 / SECURITY AND OVERSIGHTControls on this website, today
The table describes only the useatiende.ai informational website and its contact form, as currently configured. It does not describe the controls of an agent project, which are agreed per implementation. Updated: September 30, 2026.
Controls implemented on the informational website| Control | Status | What it means |
|---|
| Encrypted connection | Implemented | The site is served over HTTPS and sends the HSTS header so the browser always uses secure connections. |
| Security headers | Implemented | Content security policy, protection against embedding in other sites, no content-type sniffing and restricted browser permissions (camera, microphone, geolocation). |
| Form protection | Implemented | Request origin check, per-field length limits, a honeypot field against automated submissions, a per-address request limit and escaping of the content before emailing it. |
| Minimal tracking | Implemented | By default only a functional language cookie: analytics and advertising load only if you accept them. Cal.com loads only when you activate it: by pressing “Load calendar” on the contact page, or by continuing to pick a time after you submit your details on the demo page. |
| Reporting channel | Implemented | Security contact published at /.well-known/security.txt and in the responsible disclosure section. |
Project controls: what is defined and when
The following controls are not a statement of what already exists in every solution: they are the points we review and document in each project’s proposal so your IT team knows what to expect before signing. Their status is “defined per project” until agreed and tested.
Controls agreed per implementation| Control | Status | What is defined |
|---|
| Roles and permissions | Defined per project | Which data and actions the agent may use and who grants or revokes access. |
| Human approval | Defined per project | Which actions need a person, who decides and what happens if they are unavailable. |
| Action logging | Defined per project | What is logged, who can consult it and for how long it is kept. |
| Data and providers | Defined per project | Which data is processed, where, with which providers and how it is deleted or returned at the end. |
| Corporate authentication and data residency | Under evaluation | Feasibility is reviewed when your organization requires it; it is not promised in advance. |
What we do not have yet
We prefer to say it plainly. As of this page’s date, Atiende does not hold SOC 2 or ISO 27001 certification, and we do not publish external penetration test reports. We also have no trust center with downloadable documents, no vulnerability bounty program, no published SLA and no availability history.
If your company requires any of these, let’s talk about scope and timing before moving forward: you can complete a questionnaire with us, review what evidence we can provide and decide whether the project can start under bounded conditions. The documents we can prepare per project are on the procurement documents page, and live measurements of the site are on the status page.
- No third-party certifications (SOC 2, ISO 27001) to date.
- No public penetration test report.
- No published SLA or availability history.
08 / SECURITY AND OVERSIGHTTechnical review before committing to controls
This page describes working principles; it does not claim certification or guarantee that every control exists in every solution. If your process requires audits, data residency, corporate authentication or specific agreements, we will review those requirements and their feasibility before finalizing a proposal. Available evidence and applicable commitments are shared through the project evaluation process.
09 / SECURITY AND OVERSIGHTResponsible disclosure
If you find a possible vulnerability on this website, email ventas@useatiende.ai with the subject “Security” and describe what you observed, on which page or path and how to reproduce it. Our contact details for security reports are also published at /.well-known/security.txt.
We ask that you act in good faith: do not access, modify or retain third-party data, do not degrade the service, do not use social engineering against people and give us a reasonable period to fix the issue before disclosing it publicly. Do not include credentials or customer data in the first message. This website does not offer a bounty program.
10 / SECURITY AND OVERSIGHTReport a concern
To request security information or report a possible issue, email ventas@useatiende.ai with the affected page or solution and a general description. Avoid including credentials, customer data or sensitive information in the initial message. We will coordinate an appropriate channel to review the details.
