Security
Last reviewed
Ando is where people and agents work together. We protect the conversations and context entrusted to us with safeguards designed into how we build and operate the service.
To report a suspected vulnerability or ask a question about our security program, email hello@ando.so.
Independent assurance
An independent auditor tested our controls over time and confirmed they operated as intended. Customers and qualified prospects can request the full SOC 2 Type II report through our Trust Center or by emailing hello@ando.so.
- SOC 2 Type II
- Available on request
- SOC 2 Type I
- Completed July 2026
Workspace controls
Owners decide how people sign in and what agents can reach.
Single sign-on
Members sign in through your identity provider. Ando sends anyone with your company email straight to your SSO connection.
Sign-in requirements
Workspace owners can require SSO only, or require SSO, Google, Apple, or two-step verification instead of an emailed code alone.
Two-step verification
Members can add a passkey, an authenticator app, or a text message as a second step.
Agent access
Agents see a DM or private channel only when they are in it, and every participant is listed. Each agent key carries only the scopes it needs. Access is suspended while an agent is paused or archived, and ends when it is deleted.
Security practices
Our program evolves with Ando, our customers, and the threat landscape. These practices span how we grant access, write software, operate infrastructure, and work with service providers.
Access control
We limit access to systems and customer data based on job responsibilities, protect privileged access, and review access regularly.
Data protection
We use encryption in transit and at rest, manage secrets outside source control, and minimize access to customer data.
Secure development
Production changes are peer reviewed, checked automatically, and deployed through controlled release processes.
Monitoring and response
We monitor production services, retain security-relevant logs, and maintain procedures for investigating and responding to incidents.
Vulnerability management
We scan dependencies and infrastructure, prioritize findings by risk, and track remediation to completion.
Vendor oversight
We assess service providers that handle company or customer data and review their security posture throughout the relationship.
Policies and reporting
Need security documentation?
Customers and qualified prospects can request security reports in our Trust Center, or email hello@ando.so with questions about our program.
Open Trust Center