Security
Security and data protection
AgBaseline handles borrower financial detail for regulated lenders. Here is exactly how that data is protected — and what we have not done yet.
Identity and access
Sign-in runs on Microsoft Entra External ID. Multi-factor authentication is required by conditional access policy. Sessions end automatically after a period of inactivity. Access requires an account provisioned to your organization — a sign-in that has not been provisioned is denied at the API, not merely hidden in the interface.
Authorization and tenant isolation
Every record carries an organization identifier and is partitioned by it. Authorization is resolved server-side from your provisioned user record on every single request — never from a claim the browser can influence. A user in one organization cannot address another organization’s data.
Roles
Inspector, Manager, and Administrator. Portfolio reporting, organization settings, deleted-item recovery, and the activity feed are restricted to Manager or Administrator, and enforced on the server, not just hidden in the interface.
Encryption and residency
TLS in transit. Encrypted at rest. Hosted on Microsoft Azure in United States regions. Identity data is held with US data residency.
Audit logging
Record access and every mutating action — create, update, delete, restore, share, reassign — are written to an append-only audit store with actor, timestamp, and record reference.
Infrastructure
Managed Azure services throughout: Azure Cosmos DB for data, Azure Functions for the API, Azure Static Web Apps for delivery, Azure Key Vault for secrets. No self-managed servers, no borrower data on developer machines.
What we haven't done yet
We would rather tell you this than have you find out in diligence.
AgBaseline has not completed a SOC 2 examination and has not undergone a third-party penetration test. Both are planned before general availability. If your institution requires either before signing, tell us during the demo — it affects sequencing, and we'd rather know early.
Security questions, or a vendor questionnaire to complete? security@agbaseline.com
Request a demo