Hosting, Security & Compliance

Agility CMS is a SaaS platform hosted on Microsoft Azure, using Azure's globally compliant infrastructure as its backbone. Content data is encrypted in transit (TLS) and at rest (AES-256), with cryptographic keys held in a secure managed key-management service. Agility maintains SOC 2 Type II compliance, and the underlying Azure platform carries broad certifications including ISO 27001, ISO 27018, and CSA STAR. Security is delivered under a shared-responsibility model: Agility secures the platform, infrastructure, and content APIs, while the implementation partner and customer secure their own front-end application, deployment pipeline, secrets, and end-user access.

Hosting and infrastructure

Agility runs on Microsoft Azure, which provides the compute, storage, and network backbone for content storage, media/asset delivery, and key management. Instances are provisioned into one of five regions (see Data Residency & Data Regions). Building on Azure means Agility inherits Azure's physical security, network controls, and the broadest cloud-compliance coverage in the industry.

Encryption

Layer	Standard	Notes
In transit	TLS 1.2 minimum (1.3 supported)	All API and management traffic served over HTTPS/TLS; TLS 1.2 is the enforced minimum.
At rest	AES-256	Provided by the Azure platform; all stored data is encrypted by default.
Secrets & keys	Managed key-management service	Keys and secrets handled by a secure managed store; industry-standard hashing for credentials.

Key management

Cryptographic keys and application secrets are held in a secure, managed key-management service on Azure. At-rest encryption keys are managed within the Azure platform. Customer-managed keys (BYOK) are not available at this time.

Certifications and compliance

• Agility CMS holds SOC 2 Type II (reported under the AICPA Trust Services Criteria), with the current reporting period beginning August 31, 2025. The SOC 2 report is available to prospects under NDA on request.
• The underlying Microsoft Azure platform carries a broad catalogue of certifications — including SOC 1/2/3, ISO 27001, ISO 27018, and CSA STAR — inherited as part of building on Azure.

This distinction matters in an RFP: SOC 2 Type II is Agility's own attestation, while the wider ISO/CSA certifications are Azure platform certifications that Agility builds on.

Security program & governance

Agility operates a formal information-security program. A governing Information Security Policy sits over a comprehensive set of supporting policies covering the standard control domains expected of an enterprise vendor, including:

• Access control and asset management
• Data management and classification
• Cryptography
• Operations and physical security
• Secure development lifecycle
• Incident response
• Risk management
• Third-party / vendor management
• Business continuity and disaster recovery

In practice this means Agility enforces multi-factor authentication (MFA) for administrative and remote access to its systems, maintains a defined security-incident reporting and response process, classifies and protects data according to its sensitivity, builds security into its development lifecycle, and reviews its policies and verifies compliance through periodic internal and external audits. Detailed control specifics are confidential and shared under NDA as part of a security review rather than published.

The substance of individual policies and control implementations is confidential; for a security questionnaire or to review specifics under NDA, contact Agility.

Identity, access, and operational controls

Agility supports enterprise authentication and role-based access:

• Single sign-on (SSO) via SAML and providers such as Microsoft Entra, through Agility's identity provider.
• MFA can be enabled for enterprise teams that sign in with username/password.
• Fine-grained roles and permissions for least-privilege access — note that user roles are still provisioned within Agility (SSO authenticates the user; role assignment happens in Agility).
• Environment separation between staging and production content states.
• Version history / activity tracking on content and pages (who changed what, when — see Audit Trail, Logging & SIEM Integration).

Shared responsibilities

Security follows a cloud shared-responsibility split. Agility (with Azure beneath it) secures the platform; the implementation partner and customer secure what they build and operate on top.

Layer	Agility (and Azure)	Implementation partner / customer
Physical & network infrastructure	✅ Azure data centres, network controls	—
Platform & content APIs	✅ Patching, hardening, encryption at rest/in transit, key vault	—
Platform certifications (SOC 2, etc.)	✅ Maintains Agility attestation	Reviews reports; maps to its own compliance program
API keys & secrets	✅ Issues keys; secure storage server-side	✅ Stores Fetch/Preview/Management keys securely; never exposes Management/Preview keys client-side; rotates on staff change
Front-end application & hosting	—	✅ Secures the website/app, its hosting, headers, and its own CDN
User & role administration	✅ Provides RBAC, SSO, workflows	✅ Configures roles/least-privilege, manages joiners/movers/leavers, enforces MFA at the IdP
Custom code / integrations	✅ Provides APIs/SDKs/webhooks	✅ Secures custom scripts, webhook endpoints, and integration credentials