# Security & admin

> Roles decide who can see and do what. Admins choose who can connect an AI tool and who can send through it, and every change is logged.

Canonical: https://www.getsift.ai/platform/security/

## Agents get the access you give them. Nothing more.

Roles decide who can see and do what. Admins choose who can connect an AI tool and who can send through it, and every change is logged.

- ISO 27001 certified
- GDPR compliant
- SOC 2 compliant
- Encrypted in transit and at rest
- AI providers can’t train on your data

Source: [trust.getsift.ai](https://trust.getsift.ai/)

[Visit the trust center](https://trust.getsift.ai/) [Read the docs](https://docs.getsift.ai/docs/developer/mcp-connections)

ISO 27001 **Certified**

SOC 2 **Compliant**

AI access **Off by default**

## What it does

### Roles and queue access

Start from ready-made roles like Agent, Analyst, or Read-only, and choose which work queues each role can see.

### Agent access by permission

Choose which roles and people can connect AI tools like Claude, and which can send through them. Connecting AI tools is off until an admin turns it on.

### Human-confirmed sends

Replies drafted by an AI tool wait for a person to confirm them. Automated scripts can never send a reply.

### Audit log

Setting changes and everything AI tools do are logged, so you can check who did what.

### Keys that expire

API keys are shown once, expire in 30 or 90 days, and can be turned off instantly.

### MFA and sessions

Multi-factor authentication and session management for every account.

## Agents follow your permissions

Connecting an AI tool and sending through it are two separate permissions. Set them per role, then allow or block a person. An AI only ever gets the access of the person who signed in.

## Accountable by default

Setting changes and everything AI tools do go to the audit log. Keys are shown once and can be turned off anytime.

## Questions

### Which certifications do you hold?

Sift is ISO 27001 certified, SOC 2 compliant, and GDPR compliant. Details and documents are in the trust center.

### Where’s your security documentation?

The trust center lists controls and sub-processors, and you can request access to reports there.

### Can an AI client send messages by itself?

No. An AI client like Claude can prepare a reply, and a person confirms it in Sift before it sends. Auto-reply bots that your team sets up inside Sift are separate, and only run where you turn them on.

## More of the platform

[**AI triage** Score, summarize, tag, and filter every message.](https://www.getsift.ai/platform/triage/) [**AI replies** Drafts in your voice, grounded in your knowledge.](https://www.getsift.ai/platform/ai-replies/) [**Knowledge base** The facts your agents answer from.](https://www.getsift.ai/platform/knowledge-base/) [**SiftGPT** Ask your data, get answers with sources.](https://www.getsift.ai/platform/siftgpt/) [**Inbox** Every channel in one keyboard-first inbox.](https://www.getsift.ai/platform/inbox/) [**Workflows** Rules and goals that route work for you.](https://www.getsift.ai/platform/workflows/) [**Analytics** Topics, sentiment, SLAs, and custom dashboards.](https://www.getsift.ai/platform/analytics/) [**Listening** Brand mentions you weren’t tagged in.](https://www.getsift.ai/platform/listening/) [**People** Advocates, detractors, and who’s going quiet.](https://www.getsift.ai/platform/people/) [**Moderation** Spam, policy, and blocked users.](https://www.getsift.ai/platform/moderation/) [**Quality & CSAT** QA agents, reviews, and customer scores.](https://www.getsift.ai/platform/quality/)

## Bring your security questions.

We’ll walk your team through roles, agent access, and the trust center.