Security

Last updated: October 10, 2026

Garagent is operated by ZAD Creation LLC and is currently in invite-only beta. This page describes our security approach, its limitations, and precautions for using AI agents. It is an informational overview. Our Terms of Use govern use of the Service, and our Privacy Policy describes how personal information is handled.

Connection security

The public website and application use HTTPS to protect information transmitted between your browser and the Service. [Verify HTTPS enforcement, certificate validity, and coverage of production endpoints before publication.]

HTTPS does not protect information from every form of unauthorized access or prevent an authorized recipient from processing it. It is not a claim of end-to-end encryption. Information sent to AI providers or connected services is processed as described in our Privacy Policy.

Accounts and access

Garagent uses Google sign-in, and beta access is restricted to approved accounts. [Verify invitation enforcement and server-side account checks.]

Authentication identifies an account; authorization determines which records and actions it may access. Administrative access must be restricted separately from ordinary sign-in. [Describe administrator and production-access controls only after verifying them, including MFA coverage, role restrictions, session handling, and access logging.]

Protect your Google account with a strong authentication method and enable multi-factor authentication where available. Do not share accounts or invitations. Report suspected unauthorized access promptly.

Account data separation

Garagent uses account identifiers to scope access to stored records and separate workspace folders for uploaded and generated files. These are application-level controls, rather than a dedicated server or database for each customer.

[Verify account ownership checks across APIs, file downloads, uploads, task execution, background jobs, agent memory, search, and administrative functions. Confirm that agents and executable tools cannot bypass file or account boundaries before describing isolation as verified.]

Separate folders alone do not establish an execution sandbox. This page does not claim that agents run in isolated containers or that every tool has an independently enforced permission boundary.

Credentials and sensitive information

Credentials are needed to operate the Service and connect authorized integrations. [Describe verified protections for server secrets and customer credentials, including access restrictions, storage encryption if implemented, masking, log handling, rotation, revocation, and deletion.]

We do not claim encryption at rest, encrypted credential storage, or that secrets never appear in logs until those controls have been verified. Remove this drafting note and replace it with an accurate description before publication.

Do not put passwords, API keys, private keys, or access tokens in ordinary chats or uploaded files. Use designated credential controls where available, and revoke exposed credentials directly with the relevant provider. Disconnecting an integration does not necessarily revoke the external credential or undo earlier actions.

Agents and connected tools

Tools can allow agents to read files, send messages, modify records, execute code, or interact with external services, depending on the enabled capability. Grant only the access needed for the task and verify that you have authority to authorize the action.

AI agents can misunderstand instructions or be influenced by malicious instructions in websites, files, emails, and other retrieved content. Review consequential outputs, destinations, and actions. Do not assume that every action requires approval or that permissions shown in the interface are independently enforced unless the relevant feature expressly provides those controls.

Monitor scheduled tasks and disable capabilities when they are no longer needed. Actions already submitted to external services may continue or be irreversible.

Task and project history can help review recorded activity. It is not presented as a complete, tamper-proof audit log and may not capture every event in an external service.

Hosting, maintenance, and providers

Garagent is hosted on a DigitalOcean virtual server. We are responsible for maintaining our application and the server components and access controls under our management. Hosting-provider security does not by itself establish the security of our application.

[Confirm firewall configuration, administrative authentication, patching responsibilities and process, dependency updates, monitoring, and incident handling before making specific claims. Avoid publishing credentials, internal addresses, or unnecessary configuration details.]

AI providers and connected services operate their own systems. Their involvement does not remove our responsibilities for the parts of the Service we operate. Relevant providers and processing practices are described in our Privacy Policy.

Backups and recovery

[Describe the current, verified backup process for database records and workspace files, including protection, frequency, retention, and the scope and date of restoration testing. Historical migration backups are not evidence of an ongoing recovery process.]

During the beta, keep independent copies of important files and outputs. No uptime, recovery-time, or recovery-point commitment is provided unless expressly agreed in a separate written agreement. This does not limit obligations imposed by applicable law.

Backup retention and deletion practices must be consistent with our Privacy Policy.

Security incidents

Report suspected unauthorized access, exposed credentials, cross-account data exposure, or harmful agent behavior to hello@getgaragent.com. We may restrict access, pause tasks, or disable integrations while investigating a credible risk.

We will provide notifications to affected individuals and authorities where required by applicable law. We do not promise a fixed investigation or resolution time. [Verify that an incident-response process and a monitored reporting mailbox are in place before publication.]

Beta precautions

No service can guarantee complete security. This limitation does not remove our legal security or privacy obligations.

Do not use the beta for safety-critical operations or submit highly sensitive or regulated information unless we have expressly agreed in writing to support that use and appropriate safeguards are in place. Follow the information restrictions and oversight requirements in our Terms and Acceptable Use Policy.

[Do not claim SOC 2, ISO 27001, HIPAA compliance, independent penetration testing, or other certifications or assessments unless their status and scope are verified. Remove this note before publication.]

Reporting vulnerabilities

Send reports to hello@getgaragent.com. Include the affected feature, relevant dates, a description, and safe reproduction steps where possible. Remove passwords, tokens, and unnecessary personal information from examples or screenshots. Do not send illegal content or copies of other users’ private data; describe where the issue occurred instead.

If you encounter information you are not authorized to access, stop accessing it and report the exposure. Do not retrieve additional data to demonstrate the issue, modify or delete information, or disrupt the Service.

Obtain written authorization before active security testing. Authorization must specify the systems and testing scope. Garagent cannot authorize testing of third-party providers or connected services on their behalf. This page does not itself authorize testing or establish a bug bounty.

Please coordinate public disclosure with us to allow a reasonable opportunity for investigation and remediation. This request does not restrict disclosures required or protected by law, including lawful reporting to regulators or appropriate authorities. We review reports but do not promise a fixed response time, resolution deadline, or reward.

Updates and contact

We may update this overview as verified practices change. Material changes affecting personal-information handling will be addressed through the Privacy Policy and applicable notice requirements.

ZAD Creation LLC
Security questions and reports: hello@getgaragent.com.