---
title: "Trust and security for AI agents | Atiende"
description: "Who can access what, what an AI agent may do and when a person steps in is part of the design. Controls are documented for each implementation."
url: https://useatiende.ai/en/seguridad
lang: en
alternates:
  es: https://useatiende.ai/es/seguridad
  en: https://useatiende.ai/en/seguridad
updated: 2026-10-06
---

# Control built into process design.

Defining who may access information, what automation may do and when a person must intervene is part of the design. Specific controls are documented for each implementation.

## Permissions that follow responsibility

Access design starts by identifying roles and the actions they need to perform. Reading a record is not the same as modifying it; preparing a proposal is not the same as approving it. The permission matrix should reflect those differences and account for the capabilities of connected systems.

- Access limited to the data and actions required by the process.
- Owners responsible for authorizing, reviewing and revoking permissions.
- An explicit distinction between automatic actions and decisions approved by a person.

## Information with a defined purpose

Before connecting a source, we identify the data the use case requires, where it will be processed and who will administer it. The selection of providers, models, environments and retention policies belongs in the technical scope. Your organization’s restrictions must be reviewed before introducing sensitive or regulated information.

## Boundaries for consequential actions

An agent needs a clear path when information is missing, a request exceeds its scope or another system’s response is uncertain. Confirmation and escalation points are designed around the risk of each task. Contract changes, eligibility decisions and financial movements require specific review; their appearance in a website scenario does not authorize them.

## Agreed traceability and evaluation

Reviewing a process requires knowing which request arrived, which sources were consulted and which action was attempted. Logging scope, access to evidence, retention periods and error review are agreed per project. Evaluation should include misuse, unexpected instructions and answers unsupported by sufficient information.

## Controls on this website, today

The table describes only the useatiende.ai informational website and its contact form, as currently configured. It does not describe the controls of an agent project, which are agreed per implementation. Updated: September 30, 2026.

**Controls implemented on the informational website**
| Control | Status | What it means |
| --- | --- | --- |
| Encrypted connection | Implemented | The site is served over HTTPS and sends the HSTS header so the browser always uses secure connections. |
| Security headers | Implemented | Content security policy, protection against embedding in other sites, no content-type sniffing and restricted browser permissions (camera, microphone, geolocation). |
| Form protection | Implemented | Request origin check, per-field length limits, a honeypot field against automated submissions, a per-address request limit and escaping of the content before emailing it. |
| Minimal tracking | Implemented | By default only a functional language cookie: analytics and advertising load only if you accept them. Cal.com loads only when you activate it: by pressing “Load calendar” on the contact page, or by continuing to pick a time after you submit your details on the demo page. |
| Reporting channel | Implemented | Security contact published at /.well-known/security.txt and in the responsible disclosure section. |

## Project controls: what is defined and when

The following controls are not a statement of what already exists in every solution: they are the points we review and document in each project’s proposal so your IT team knows what to expect before signing. Their status is “defined per project” until agreed and tested.

**Controls agreed per implementation**
| Control | Status | What is defined |
| --- | --- | --- |
| Roles and permissions | Defined per project | Which data and actions the agent may use and who grants or revokes access. |
| Human approval | Defined per project | Which actions need a person, who decides and what happens if they are unavailable. |
| Action logging | Defined per project | What is logged, who can consult it and for how long it is kept. |
| Data and providers | Defined per project | Which data is processed, where, with which providers and how it is deleted or returned at the end. |
| Corporate authentication and data residency | Under evaluation | Feasibility is reviewed when your organization requires it; it is not promised in advance. |

## What we do not have yet

We prefer to say it plainly. As of this page’s date, Atiende does not hold SOC 2 or ISO 27001 certification, and we do not publish external penetration test reports. We also have no trust center with downloadable documents, no vulnerability bounty program, no published SLA and no availability history.

If your company requires any of these, let’s talk about scope and timing before moving forward: you can complete a questionnaire with us, review what evidence we can provide and decide whether the project can start under bounded conditions. The documents we can prepare per project are on the procurement documents page, and live measurements of the site are on the status page.

- No third-party certifications (SOC 2, ISO 27001) to date.
- No public penetration test report.
- No published SLA or availability history.

## Technical review before committing to controls

This page describes working principles; it does not claim certification or guarantee that every control exists in every solution. If your process requires audits, data residency, corporate authentication or specific agreements, we will review those requirements and their feasibility before finalizing a proposal. Available evidence and applicable commitments are shared through the project evaluation process.

## Responsible disclosure

If you find a possible vulnerability on this website, email ventas@useatiende.ai with the subject “Security” and describe what you observed, on which page or path and how to reproduce it. Our contact details for security reports are also published at /.well-known/security.txt.

We ask that you act in good faith: do not access, modify or retain third-party data, do not degrade the service, do not use social engineering against people and give us a reasonable period to fix the issue before disclosing it publicly. Do not include credentials or customer data in the first message. This website does not offer a bounty program.

## Report a concern

To request security information or report a possible issue, email ventas@useatiende.ai with the affected page or solution and a general description. Avoid including credentials, customer data or sensitive information in the initial message. We will coordinate an appropriate channel to review the details.

## Frequently asked questions

### Does Atiende hold certifications shown on other platforms?

We do not attribute third-party certifications to Atiende. Your assessment requirements and available evidence are reviewed directly with the team before contracting.

### Do you have SOC 2 or ISO 27001?

No, we do not hold those certifications to date. If your company requires them, let’s discuss scope and timing; the “What we do not have yet” section covers the rest.

### Where do I request the DPA or security questionnaire?

Email ventas@useatiende.ai with the subject “Documents”. The procurement documents page explains what we can prepare per project.

### Can I keep human approval in the workflow?

We can include it as a design requirement. You need to define which actions require approval, who decides and what happens when that person is unavailable; the specific implementation is validated in the scope.

---
Book a demo: https://useatiende.ai/en/demo
Contact: ventas@useatiende.ai · https://useatiende.ai/en/contacto
Sitemap: https://useatiende.ai/sitemap.xml · llms.txt: https://useatiende.ai/llms.txt