Suede AI Agent StudioDocsStart buildingOpen workspace
Navigation menu

Help & account5 min readUpdated

Suede AI Agent Studio security and privacy: how your data is protected

Quick answer

Suede AI Agent Studio encrypts every request in transit, scopes every read and write to your workspace, seals stored credentials with AES-256-GCM and stops every run at a hard spend cap. Suede AI does not sell personal data and does not use your inputs to train models. Every control is listed on the Security and Privacy pages.

What you'll have

  • Answers for a client's security questionnaire, drawn from shipped controls
  • A full list of what Agent Studio stores and who processes it
  • Control over optional analytics and ad measurement
  • A direct line for security reviews and vulnerability reports
On this page
  1. How does Agent Studio protect my data?
  2. What data does Agent Studio collect?
  3. Which companies process my Agent Studio data?
  4. How do I turn analytics and ad measurement off?
  5. Is Agent Studio ready for my client's security review?
  6. How do I report a vulnerability?
  7. Questions
  • AES-256-GCMEncryption on every stored connection credential
  • HMAC-SHA256Signature on every inbound webhook call
  • HTTPSOn every request to agents.suedeai.ai
  • 1 business dayTypical reply to a security report

How does Agent Studio protect my data?#

Agent Studio guards your data at every layer, from the browser to the database. Here is each control and what it does for you.

Agent Studio protection, layer by layer
LayerWhat Agent Studio does
In transitServes every request over HTTPS. The workspace cookie is HttpOnly and Secure, so page scripts never read it and it never travels over plain HTTP.
Sign-inKeeps your session in a host-only cookie that never leaves agents.suedeai.ai.
Workspace isolationResolves every request to a workspace owner before it touches storage. A request without one fails closed instead of landing in a shared account.
DatabaseStores data in managed Postgres on Supabase behind row-level security. Browsers cannot read or write the tables, and the runtime role has no delete privilege.
Stored credentialsEncrypts each connection secret with AES-256-GCM, binds it to your workspace and that connection, and wipes the plaintext from memory after use.
WebhooksRequires an HMAC-SHA256 signature and a recent timestamp, rejects replays, and stores your signing secret only as a hash after showing it to you once.
SpendRuns model calls only against prepaid credit and stops every run at a hard per-run spend ceiling.

What data does Agent Studio collect?#

Agent Studio collects what it needs to run your work and make the product better, and nothing it would sell.

  • A workspace cookie (agx_owner): a random identifier with no personal details, kept up to one year so you come back to the flows and agents you built.
  • Product analytics through PostHog on page views and in-app use. No session replays, and your browser's Do Not Track setting is respected.
  • Agent inputs and outputs from your dry runs and live runs, so the flow executes and you see your own run history.
  • Your account email when you sign in, so your workspace follows you to any device.

Which companies process my Agent Studio data?#

A short list of established providers, each with one job.

Service providers behind Agent Studio
ProviderRole
VercelHosting and global edge delivery
SupabaseDatabase for flows, agents and run records
PostHogProduct analytics
Model providersRun the model steps in your flows over their own encrypted APIs
StripeCard checkout and the billing portal
Google AnalyticsOptional public-page measurement that stays off until you allow it
XOptional ad measurement you switch off with one control

How do I turn analytics and ad measurement off?#

Use the controls at the bottom of public pages; your choice saves in your browser.

  • Google Analytics stays off until you allow it. It never sees private workspaces, reports, payment pages, form values or agent inputs.
  • X ad measurement switches off with its control at the bottom of the Privacy page. It never runs inside the iOS or Android apps.
  • Do Not Track and Global Privacy Control keep both tags off automatically.

Is Agent Studio ready for my client's security review?#

Yes. Send your questionnaire, DPA request or architecture review to security@suedeai.ai and Suede AI works through it with your procurement team directly. Flows export to TypeScript with the Suede AI SDK, so your engineers can read, own and self-host the exact logic.

Run your own security review

0 of 5 done

  1. Step 1: Read the Security page

    Every control, from encryption to spend caps, in plain language.
    Open Security

  2. Step 2: Read the Privacy Policy

    What we collect, why, and every third party that touches it.
    Open Privacy

  3. Step 3: Review the Terms

    Workspaces, accounts, usage credit and acceptable use.
    Open Terms

  4. Step 4: Check live service health

    Live checks and 30 days of availability on the status page.
    Open Status

  5. Step 5: Confirm the deletion path

    How to remove a workspace and the shared login on request.
    Open deletion page

How do I report a vulnerability?#

Email security@suedeai.ai. The machine-readable disclosure policy lives at /.well-known/security.txt. Suede AI reads every report directly and typically replies within one business day. Give us the chance to ship a fix before you disclose an issue publicly.

Questions buyers ask#

Does Agent Studio train AI models on my data?

No. Your agent inputs and outputs run your flows and fill your run history. Suede AI does not use them to train models and does not sell personal data.

Where is Agent Studio data stored?

In managed Postgres on Supabase behind row-level security, with the app hosted on Vercel. Browsers never touch the tables directly; the app reaches them through a server-only secret.

How does Agent Studio store my API keys and app connections?

Each connection secret is encrypted with AES-256-GCM before it is written, bound to your workspace and that connection so it cannot be replayed elsewhere, and wiped from memory after use.

Is Agent Studio SOC 2 certified?

A third-party audit toward SOC 2 Type II is next on the Suede AI security roadmap. Send your questionnaire to security@suedeai.ai today and the team answers it from the shipped controls on the Security page.

Can I export or delete my Agent Studio data?

Yes. Email support@suedeai.ai for an export, and use the account deletion page to remove your workspace and the shared login.

Can a runaway agent run up a huge bill?

No. Every model call needs prepaid credit before it runs, every run stops at a hard per-run spend ceiling, and loops stop at an iteration cap.

Was this page helpful?

Good work starts with a clear flow.

Give an agent a job. Connect the steps. See how the work becomes a service someone else can call.

Input
Reason
Output

A workflow you can inspect

Make the steps visible.

Start with a template or describe the job. Connect inputs, reasoning, and output on the canvas.

Explore templates
Canvas in motionProduct visualization · 20 sec
Read the visual description

A stylized organization chart opens into a workflow canvas. Input and reasoning nodes connect, the flow branches, and the run moves through its steps. The film ends with Suede AI Agent Studio. Music only; no spoken narration.