Security
How Autessa Evaluations handles your conversations
Evaluation data is conversation data, so it gets the same care as the conversations themselves. Graded transcripts aren’t added to agent history, batch results are encrypted, check results stay with your team, and every permission follows the agent’s sharing.
Data handling
What happens to evaluation data?
Transcripts you grade aren’t added to agent history
Transcripts sent to Transcript Grading or the Grading API are not stored as agent history. Batch transcripts and their results are kept encrypted for retrieval.
Check results stay with your team
Response check results and evaluations are never shown to the customer and aren’t returned by the client conversation API.
Checks fail closed
If a pattern is invalid, a script errors or an AI review times out, the check counts as failed and its action applies, so a broken check never lets a reply through. Flag-only checks just record the error.
Private values never reach the model
When a tool asks the customer for a private value like a card number, it goes straight to the tool, and a tool result that echoes it is masked before the model reads it. A detector backs this up.
Script rules are sandboxed
Script rules run on their own, without platform calls or network access, and must finish within 2 seconds.
Signed webhooks
Batch job webhooks carry an HMAC-SHA256 signature over the timestamp and body, keyed by a secret shown only once when the job is created.
Your model, your privacy settings
Automated evaluations, simulated users and judges run on your company default model, which can be your own connected model provider, and company-wide PII and PHI stripping applies to them.
Test runs are real runs
Sandbox conversations run the real agent with its real tools, so tools that change data should point at test data. Agents that need a browser or ask for private values are not driven headlessly.
Permissions
Who can see and change evaluations?
Evaluations follow the agent’s sharing levels. Conversations started through the API or an app are visible to the person they ran as, the agent’s Admins and company Admins.
| Level | Can |
|---|---|
| Read | View the agent, its versions and history it can see, and test-run it. |
| Write | Edit the draft, test sets and checks, and record human evaluations. |
| Publish | Publish and roll back versions; checks reach customers only in a published version. |
| Admin | Share and delete the agent. The owner is always an Admin. |
| Transcript Grading | Needs the Agentic Workflows permission in the web app; the API takes any enabled API key of your company. |
| AutoEval | Configured in the web app by people who manage billing for the company. |
Audit
A record of every verdict
Every human evaluation records who evaluated and when, set from the signed-in user. Every checked reply carries a Response checks card with each check’s result, what happened to the reply and the original draft when the customer got something different.
For Autessa’s company-wide security program, certifications and policies, visit the Trust Center.
100% customizable, code and all
Make Autessa Evaluations fully your own.
Use it out of the box, then change anything. Ask Autobot, Autessa’s AI builder, for a new field, screen, report, workflow or agent and it builds it into your copy of the app. Or open the code and edit it yourself. Nothing is locked: the app, its data and its code are yours.
Start free and make it yours