- In transit: TLS 1.2+ for all agent–server and browser–server traffic.
- At rest: AES-256.
- Access: role-based, with optional SSO and enforced MFA on Enterprise.
- Least data: the agent collects metadata only, so there is no screen or message content to protect in the first place.
- Audit: who viewed what is logged (Enterprise).
Ask support for the current security overview / DPA for your contract.