Security & trust

A SageRock persona works with your real data — enrollment records, analytics, admissions pipelines. So the first question that matters isn't “what can it do?” It's “who is allowed to ask, and what can they get back?” Here's how we protect your information, in plain terms.

Only people you authorize can reach a persona

Every message is checked twice before a persona reads a single word of it.

First, we verify the message really came from who it claims to. Email “from” addresses are trivial to forge — so we don't trust them on their own. We use the same cryptographic checks that underpin DMARC, the standard the major mail providers rely on: a message is only accepted if its DKIM signature or SPF result aligns with the sending domain. A spoofed address that doesn't carry a valid, aligned signature is refused — it never reaches the persona, and it's set aside for a human to look at instead.

Second, we check the verified sender against your allowlist. Each persona is configured with the exact domains and email addresses permitted to use it. Someone can be a real, verified sender and still be turned away because they're not on your list. Both checks have to pass.

Each persona sees only its own client's data

A persona is scoped to one client. That boundary isn't a preference or a prompt we hope the AI respects — it's enforced at the data layer. Which client a persona belongs to is fixed in its configuration, never inferred from who emailed it, and every database query is filtered by that client. There is no path by which asking a persona a clever question returns another organization's records.

A persona can only reach the specific tools and data sources you connect to it.
It can't browse the wider database or reach another client's tenant.
More sensitive material is held in a separate, isolated store — a persona built for general content never even loads the keys to the protected one.

Your connection credentials are encrypted

To do its job, a persona holds keys to your systems — an analytics token, a CRM connection. Those credentials are encrypted at rest with AES-256-GCM (authenticated encryption), each with its own unique nonce, and are only decrypted in memory at the moment a request runs. Someone with a copy of the database still could not read them without the separate encryption key, which is never stored alongside the data.

Everything travels encrypted

Mail is delivered over TLS, and every connection between the service, its database, and the systems it integrates with is encrypted in transit. Nothing moves in the clear.

A human stays in the loop

A persona knows its limits. When a request falls outside its role, when a tool fails, or when something needs judgment, it doesn't guess — it hands the message to a real person at SageRock and tells you it did. New personas also start in a review mode, where a human approves their replies before any go out, until they've earned trust on your real traffic.

What we're honest about. Email is a convenient front door, but it isn't end-to-end encrypted by nature — so please don't send a persona passwords, full payment details, or government ID numbers, just as you wouldn't email those to a colleague. A persona only knows what you deliberately connect it to; it has no standing access to anything else. And we keep a log of messages for auditing and troubleshooting, visible only to SageRock.

Questions, or reporting a concern

If you have a security question, want detail on how your specific persona is configured, or believe you've found a vulnerability, email sage@sagerock.com directly. We take it seriously and will respond quickly.

Last reviewed: July 2026.