Security
Agoo holds names, phone numbers, photos and sometimes ID numbers. Every part of the platform is built to keep them private, correct and available, and to prove it to your auditors.
Controls
TLS for everything in transit. Databases, backups and files encrypted at rest with AES-256.
Every record belongs to one organisation, and isolation is enforced at the data layer, not only in the app.
Front desk, hosts, security and admins each see only what their role and site allow.
Sign in with Google or Microsoft work accounts on every plan, Free included, at no extra price, with the accounts and organisations you allow, and require it if you like; start your organisation with one too, and Agoo receives only your name and confirmed email. SAML and SCIM on Pro. Two-step verification still applies, required for Owners and Admins and open to everyone. Your Owner always keeps a password and authenticator, so an outage elsewhere never locks you out, and Agoo’s own staff sign in to its administration with security keys.
Append-only, hash-chained records of every action, checked with Verify chain, kept for up to seven years.
Agoo staff never use your password. When we help, we see your organisation read-only, for a set time, and every Owner is told at once and can end it. Changes need an Owner’s approval. Emergency access, for what can’t wait, tells every Owner and Admin and is followed by a written report within 72 hours.
Lost a phone? A reset needs your inbox and a colleague who has checked it’s really you, or our own identity check and a 24-hour wait. A new Owner, when yours has gone, needs evidence and 72 hours’ notice that your Owner and Admins can stop.
Set how long to keep each kind of data. Deletion runs every hour and is logged.
Application and database hosted in the United Kingdom, with daily backups and edge delivery through Cloudflare.
status.agoo.ardent.africa checks every part of Agoo every minute from outside, and runs separately so it stays up even if Agoo doesn’t. It shows what’s happening now, planned maintenance and 90 days of history, and emails you updates if you subscribe.
Feedback your staff send Agoo never reaches your organisation, and what visitors tell you in surveys never feeds a public score. On Agoo Reviews, every reviewer’s account is confirmed by phone or email, but that phone number or email is never shown to anyone: reviewers appear as a first name and initial, or a display name they choose. Every review is labelled with how it was checked, Verified visit labels come only from real visits, and no business can edit, hide, reorder or pay to change a review. Money never changes a score, the order of reviews or a place in search: the part of Agoo Reviews that works out scores and search order can’t see plans, payments or whether a business uses Agoo. Reviews of clinics and places of worship never show on a reviewer’s public profile. An Agoo Reviews account is kept apart from Agoo at work: signing in to review opens nothing of any organisation, your organisation never sees whether you review, and reviewers can keep their profile private or delete their account at any time. Review invitations go to everyone or no one; customer contacts a business gives for them are sealed as they arrive and deleted 30 days after the link ends, a forwarding address reads only who an email went to and keeps nothing, the business sees totals but never which invitation became which review, and anyone can stop invitations from one business or every business. Website review widgets set no cookies and count no one. Photos a business adds are re-made without their location or camera details and checked by a person before they show; a reader's lists are private unless they share one by link, and a shared list is never shown to search engines.
Paid through Paystack’s own checkout. Card and mobile money details are handled by Paystack and never stored by Agoo; a saved card renews with Paystack’s token, kept encrypted and deleted when the card is removed. Every payment is checked with Paystack before anything changes, and test payments can never count as real ones.
Audit trail
Who approved which visitor, who exported what, who changed a setting: time, person and IP address, in an append-only log. Each entry carries the hash of the one before, so any change to history shows.
Screening
Watchlist checks run at check-in on names, phone numbers and ID numbers, on kiosks and guard devices even with no network. A match holds the check-in and alerts security without a scene at the desk. Overrides need a reason, and every one is logged.
Data and privacy
Banks, hospitals and public bodies answer to auditors and regulators. In Agoo you decide how long each kind of data is kept, deletion happens on schedule with a record of every run, a legal hold stops it when you need to, and you can take everything with you at any time.
Set in Console → Settings → Data & privacy, also for bookings, deliveries, attendance and leave. Before a shorter period is saved, Agoo counts what it would delete and asks you to confirm.
| Kind of data | How it’s counted |
|---|---|
| Visits | From when the visit ended. A visitor goes with their last visit. |
| Visitor photos | From when the photo was taken. Often a short period. |
| ID photos | From when the photo was taken. 1 day unless you choose otherwise, and 30 days at most. Never of a Ghana Card. |
| ID numbers | From the visitor’s last visit. Sealed, with only the last four shown; seeing a full number takes a reason, and is recorded. |
| Answers to your questions | From when the visit ended, and each question can have its own, shorter period. |
| Messages sent | The address and text go; the record that a message was sent, and its cost, stays. |
| QR code scans | From the scan. 2 years unless you choose otherwise, and never an IP address. |
| Guest Wi-Fi given | With the visit it was given on: who, when and how, never anything about their phone. Erased with the visitor. |
| Signed documents | With the visit they were signed for. Erasing a visitor clears their typed name, signature, IP address and browser; the record of what was agreed stays. |
| Vehicle register | From when the vehicle left: plates, drivers and photos. 30 days unless you choose otherwise; a vehicle still inside stays until it leaves. |
| Bookings | From when the meeting ended, or was cancelled or declined. A year unless you choose otherwise. |
| Deliveries | From when the parcel was collected or sent back. A year unless you choose otherwise; a parcel still waiting is never deleted. |
| Parcel photos | Label and parcel photos, what the AI read, riders’ phone numbers and signatures, from when the parcel was collected or sent back. 90 days unless you choose otherwise. |
| Leave records | From the end of the leave, and for balances the end of the leave year. 7 years unless you choose between 1 and 10, as the Labour Act asks employers to keep them. |
| Leave certificates | From the end of the leave they support. 24 months unless you choose between 30 days and 2 years; a legal hold keeps them, and HR can delete one sooner. |
| HR records | A person’s HR record, contacts, job history, change requests, the Ghana Card, SSNIT and TIN numbers and pay accounts payroll needs, and their contracts, letters and certificates, from the day they leave. 6 years unless you choose between 1 and 10, as tax and contract law ask; Agoo warns you under 6. |
| Other identity numbers | Passport, permit, licence and voter ID numbers on a staff record, and identity documents’ files, from the day the person leaves. A year unless you choose up to 6 years. |
| Health documents | Medical certificates, police clearance and other special personal data in a staff member’s documents, seen only by them and HR, from the day each stops being current. 2 years unless you choose between 30 days and 6 years. |
| Booking waitlists | Each entry is removed once the day it was waiting for has passed. |
| Visit request and booking codes | Kept only in scrambled form, and deleted within a day. |
| Audit trail | Oldest entries first, so the chain still verifies. |
How much visitor history each plan shows, and how long it keeps the audit trail. A move to a lower plan never deletes anything: older records are hidden, and come back when you move up.
| Plan | Visitor history | Audit trail |
|---|---|---|
| Free | 3 months shown | 7 days |
| Starter | 12 months | 90 days |
| Growth | 24 months | 1 year |
| Pro | Up to 5 years | 3 years |
| Enterprise | Custom, legal hold | Up to 7 years |
Runs every hour on its own. Each run is recorded in the audit trail with how many records of each kind went, and listed in Data & privacy, so you can show auditors your rules work. Deleted data can’t be recovered, and backup copies expire within 30 more days.
During an investigation, a dispute or a regulator’s request, place a hold on the whole organisation, a site, a person or a visitor. Scheduled deletion and erasure stop for what it covers until you lift it, and both are in the audit trail.
Owners and Admins can take everything Agoo keeps for the organisation, on every plan: a ZIP with a CSV file for each kind of record and the files still kept. You’re emailed when it’s ready and download it in the Console within 7 days. Passwords, keys and full ID numbers never leave Agoo.
What people type in Agoo is kept on their own device as they type, so a power cut or a dropped connection loses nothing. It belongs to that person in that organisation alone, so nobody else on a shared reception computer sees it, and it’s removed when they sign out. The form builder and QR studio also save work in progress to the person’s account, which only they can see. Drafts with visitors’ details expire after 7 days, others after 30. Passwords, codes, card and mobile money details are never kept.
People and access
Everyone who signs in has a role, and sees only what that role and their sites allow. Each person looks after their own profile and chooses how alerts reach them. Visitors never sign in: their links work only for them.
One Agoo ID for every product. Agoo at work, Agoo Reviews and Agoo Forms share one account for each person, never joined because two addresses look alike.
About Agoo IDOwner, Admin, Site admin, HR, Finance, Receptionist, Security lead, Guard, Host, Employee and Auditor, each seeing only what the role allows. HR keeps staff records, leave, timesheets and, on Pro, payroll files without billing, security or settings, and a line manager sees only their own team’s jobs, never their personal details. Finance, for whoever pays, is given only by the Owner and sees no HR records, numbers or accounts. Nobody approves their own leave, extra time or timesheet, an approved timesheet is locked until someone reopens it with a reason, and every decision, deputy, reopening, change to who approves, payroll file made and payroll file downloaded is in the audit trail. On Growth and above, limit any role to its own sites.
A sign-in link is a credential, so invitations go by email only, and links expire. Invite later, import people from a CSV file on Growth and above, or add people who receive visitors without signing in.
Required for Owners and Admins, and open to everyone with an authenticator app: once someone adds one, every sign-in asks for it. Passkeys and security keys sign in with a face, fingerprint or screen lock, count as both steps and can’t be phished by a fake page. Backup codes, so a lost phone doesn’t lock you out. Changing a sign-in email is confirmed at both addresses.
A long phrase counts for more than a clever jumble, and nobody is made to change a good password on a schedule. Passwords are checked against known breached passwords, and sign-in pages are protected against automated attacks.
Everyone sees each browser and phone signed in to their account, roughly where, and when it was last used, as it happens, and signs any of them out at once. A sign-in on a new device is emailed and sent to their phone. Owners and Admins sign a member out everywhere, and can make sign-ins shorter for everyone, on every plan.
A trusted browser stays signed in for 30 days, or until it’s unused for a week; untick Keep me signed in on a shared computer and it ends when the browser closes. The Agoo Workspace app opens with the phone’s own lock each time and asks for the password every 30 days.
People add a photo, the name they go by and their pronouns, within what you let them change. Photos are re-made without location or camera details.
Each person chooses WhatsApp, SMS or email for each alert, and quiet hours. Security holds and roll call’s “Are you safe?” always come through.
An organisation joins a group only when its Owner accepts, and chooses what the group gets: totals only, read-only or admin. Group admins need two-step verification, everything they do is marked in your audit trail, and leaving ends their access at once.
Pages update as things change, without a refresh. What travels to the screen is only a note that something changed, never a name or a number: the page then asks again, and sees only what the person may see. Only signed-in people with the right role can listen, each to their own organisation.
Change a role or remove someone’s sign-in and it applies on their next click. Agoo emails them, and the change is in the audit trail.
The link in a visitor’s message is their key to their pass, so it’s treated like one: visitor pages never pass it on to other sites, aren’t indexed by search engines, and the link isn’t kept in logs. A host’s approval link works once, within 24 hours.
Visitors checking in from a poster find their host by typing a name and see five names at most, never a staff list. Until reception knows them, they’re treated as unverified, so typing someone else’s phone number never shows that person’s details. Their details follow your retention settings.
You can leave anyone out of the names visitors find at the kiosk and on your visitor pages, and send walk-ins who ask for them to their assistant, their office or reception first; the visitor is never told why they wait. Visitors see only the teams you’ve marked for them, by typing, never a list. A visit for several people or a team is seen by the people it is for, as a host sees their own visitor, and by nobody new; someone who declines stops seeing it. Every question, answer, answer written down for someone else, hand-over and turning away is on the visit’s timeline and in the audit trail, with who did it.
Asking to visit, booking an appointment and joining a waitlist all need a one-time code sent to the person’s phone or email, so nobody can fill a host’s diary with fake bookings or make Agoo message strangers. Codes are kept only in scrambled form, expire within minutes and are limited for each phone, email and organisation. Every visit request waits for its host, and the watchlist checks requests too.
Every pass carries a code digitally signed with your organisation’s own key, so a kiosk or guard can tell a real pass from a forged or altered one with no network. A pass waiting for approval is never signed, a cancelled pass is refused, and you can replace the key in Settings whenever you like. The private key is never stored.
A kiosk pairs with a one-time code that works for 10 minutes, and nobody signs in on it. It gets its own identity, kept in the device’s secure hardware. On iPad and iPhone, Apple confirms it’s a genuine copy of Agoo Kiosk on a genuine device, and an Android device proves the same wherever it can. Every request a kiosk makes is signed, so copying what it holds gets nobody in. Its menu opens only with a device PIN, and unpairing it in the Console cuts it off at once and wipes it.
A kiosk keeps only what its own site needs to work offline: today's visits, hosts' names, your forms and documents, staff names for clock-in with one-way fingerprints of their badges, cards and PINs (and, for a badge on a phone, only what's needed to check its code, which can't make one), and, with the watchlist, one-way fingerprints of its entries. Never visitors' phone numbers, emails or ID numbers, and never the names or numbers on your watchlist. The device encrypts it with its passcode, a visitor's photo or ID image leaves the kiosk as soon as it's uploaded, and unpairing wipes the lot. On a kiosk visitors use themselves, nobody's name is shown until they start typing their own.
A front-desk computer becomes a kiosk in its browser by being paired once, with a single-use code from the Console that lasts ten minutes. From then on the browser keeps a key of its own that can’t be copied off it, and signs every request with it. It can only do what a kiosk does, at its one site. On a public screen, visitors and staff looking for their own name see nothing until three letters are typed, and then only a first name and an initial. Nothing a visitor types is kept on the computer, and the screen forgets everything when it’s left alone. Staff PINs are checked by Agoo, with a lock-out after repeated wrong tries. Unpairing it in the Console stops it at once, and you can switch kiosks in a browser off for your whole organisation.
Agoo Workspace opens with the phone’s own unlock (Face ID, Touch ID or the passcode on iPhone and iPad; fingerprint, face unlock or the screen lock on Android), and locks again when someone leaves it. It signs in exactly like the Console, with a passkey or the same two-step verification, and nothing of your organisation’s reaches the phone until that’s done. What it keeps for working offline is only that person’s own part of Agoo, and, for the front desk and security, who’s on site at their own sites, in the phone’s encrypted storage, never backed up, and deleted when they sign out or switch organisation. When a host invites someone from their phone’s contacts, the app sees only the person they pick, never the address book, and a half-written invitation stays on that phone for 7 days at most. Its notifications can leave visitors’ names off a locked phone, if you choose, and answering one from the lock screen needs the phone unlocked first.
A staff badge shown in the Workspace app is a code that changes every 30 seconds, made by a key kept in the phone’s security chip. The key never leaves the phone, so a screenshot stops working within a minute and a copy of the app gets nobody in. Each code counts once, kiosks check it with no network, and Agoo checks it again when the clock-in arrives. Signing out removes the badge from that phone, and a lost phone’s badge can be removed from the app or the Console.
An emergency alert is sent with a two-second hold, never by a brush of the thumb. Your organisation chooses whether receptionists and guards can start one; drills and ending a roll call stay with security and admins, and every alert, mark and ending is in the audit trail. So marshals can call people without data, the roll call carries their phone numbers to the desk’s phones only while it runs, and removes them when it ends.
When someone clocks in at the site from the Workspace app, it checks their location once, as they tap, and only while the clock-in screen is open: never in the background. Before it first uses their location or takes a selfie, it shows your notice, and where you ask for consent, saying no means it isn’t taken. Coordinates leave the phone only if you choose to keep them; otherwise Agoo records only whether they were at the site. The app clocks in only the person signed in to it, and Agoo checks every punch again when it arrives.
A pass goes to Apple Wallet or Google Wallet only when the visitor taps to add it, and from then on under Apple’s or Google’s own terms. It carries the same signed code as the pass page, can’t be shared from the wallet, and is updated through Apple or Google when the visit changes, then marked as no longer valid once it’s cancelled or over. The link that adds it works once and expires within minutes.
Your own domain for visitor and booking pages, and your short-link domain on Pro and Enterprise, are served only over TLS, with a certificate we issue and renew automatically once your DNS record checks out. Only Owners and Admins can add one, Agoo’s own addresses can’t be claimed, and a short-link domain opens only your own organisation’s codes.
Your Wi-Fi passwords are sealed with their own encryption key and never appear in exports, logs or the audit trail. Seeing one in the Console takes a permission of its own, and every reveal, and every password sent to a kiosk or a phone, is recorded. Guest and staff networks are kept apart: a staff network never reaches a visitor page, a kiosk, a pass or a poster. Visitors get guest Wi-Fi only while they’re checked in: their pass, their Wallet pass and a poster’s page stop showing it at check-out, the welcome message links to their pass rather than carrying the password unless you choose otherwise, and a poster for checked-in visitors shows it only to a phone that confirmed a one-time code sent to the visitor’s own number or email. Agoo keeps who was given it and when, never their device’s details. Agoo support can’t reveal a Wi-Fi password, even with emergency access.
When someone connects Google, Microsoft or Zoom, Agoo asks for calendar and meeting access only, never mail, contacts, files or recordings, and uses only what it needs: their list of calendars, when they’re busy, the events it adds and the meetings it makes. From the calendars they choose it keeps busy start and end times only, deleted a day after they end, never titles, people or descriptions, and it only ever changes its own events. The keys to their accounts are sealed with an encryption key of their own and never shown to anyone. Owners and Admins decide who may connect and how much Agoo’s events say, and disconnecting gives up Agoo’s access where the provider allows it and removes what it kept. A private calendar link works like a key: anyone holding it can read that diary, so get a new one if it’s been shared, and the old one stops at once.
A medical or maternity certificate is health data, which Ghana’s Data Protection Act treats as special personal data. Agoo keeps it as a private file that only the person and HR can open, whether HR adds it or the person takes a photo of it in the Workspace app: not their manager, not other staff, and never integrations or the API. Each one added, opened or removed is recorded in the audit trail, and it’s deleted on your schedule. Kinds of leave you mark private, sick and maternity leave by default, show to managers only as Away, everywhere from Today to the approval itself, and integrations get only “away”, never the kind or a reason. On the roster, the Labour Act’s warnings about a woman’s consent to night work or overtime (section 55) come only from maternity leave already recorded and show only to those who may see it, such as HR; nothing about a pregnancy is ever asked or kept.
Ghana’s L.I. 2523 says an organisation mustn’t rely on looking at a Ghana Card, or on a photocopy, scan or image of one, to check who someone is. Agoo doesn’t check who anyone is, and it never keeps an image of a Ghana Card. The Agoo Kiosk app reads a Ghana Card’s number on the device and lets the picture go at once, never saving, uploading or caching it, or the visitor types the number; a kiosk in a browser always has it typed, and you can choose typing everywhere. Agoo refuses a photo of a Ghana Card wherever one is sent, and nobody compares the card with the person. A passport’s number is read the same way, with a photo of the page kept if you ask, and other IDs are photographed if you ask. Every ID number is sealed with its own encryption, only its last four characters show, and an ID answer never reaches integrations, webhooks or the API. ID photos open only for Owners, Admins and Security leads, each opening recorded, and are deleted after a day unless you choose up to 30. Agoo records the ID a visitor gives; it never claims to have checked who they are.
Ghana Card, SSNIT, TIN, passport and permit numbers, and the bank and mobile money accounts staff are paid into, are encrypted as they’re saved, each bound to its organisation, its person and its kind, so it can’t be opened as anything else. Everyone sees only the last four, the same number can’t be on two people, and the numbers never reach webhooks, the public API, notifications or logs. Only the Owner and HR can see a full number, by giving a reason; it shows for 60 seconds and the reason, the person and the time go into the audit trail. Agoo’s support team never sees them.
Every contract, licence, permit and certificate in a staff member’s documents is encrypted with a key of its own before it’s stored, photos lose their location first, and each file is checked for viruses before anyone can open it. Files open only through Agoo, for people allowed to see them: health papers are seen only by the person and HR, identity and disciplinary ones by the person, HR and the Owner, and every opening of those is recorded. No copy of a Ghana Card is ever kept.
Changing where someone is paid needs a fresh check: a code from their authenticator app in the last five minutes, or a code Agoo emails them, and in the Workspace app their phone’s own unlock first. The person is told every time, by email and on their phone, whoever made the change. If it wasn’t them, This wasn’t me holds the accounts so nothing is paid into them, signs them out everywhere else and tells HR, who check the account with them before it’s released. Every change, check and full number seen is in the audit trail.
Documents are signed with a typed name and a drawn signature under the Electronic Transactions Act, 2008 (Act 772). Each published version is fixed and fingerprinted, and Agoo keeps who signed which version, when, and the IP address and browser they used, with a PDF copy for the visitor.
Data protection
Under the Data Protection Act, 2012 (Act 843), your organisation controls the data and Agoo processes it for you. We sign a data processing agreement with every customer, give people a page to ask about their data and you an inbox, with reminders, to answer access, correction and deletion requests on time and erase what you must, and show visitors a privacy notice before they check in.
The services that process data on our behalf, as of 20 October 2026. Some apply only when a feature is turned on or launched; the full sub-processor list says when, and what data each receives.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database hosting and backups | United Kingdom |
| Vercel | Hosting for the website and web apps | United Kingdom, with a global delivery network |
| Cloudflare | Network security, file storage and delivery | Global network; files stored in Western Europe |
| Fly.io | Application hosting | United Kingdom |
| PowerSync | Offline working for Agoo’s apps | European Union |
| Twilio SendGrid | Email delivery | United States |
| Hubtel | SMS delivery | Ghana |
| Meta | WhatsApp messages | Global (Meta’s data centres) |
| Apple (Apple Push Notification service) | Push notifications | United States |
| Google (Firebase Cloud Messaging) | Push notifications | United States |
| Paystack | Payments | Ghana, Nigeria |
| Anthropic | AI features, when enabled, reading parcel labels, screening reviews on Agoo Reviews, review reply drafts and summaries, and drafting and safety-checking forms on Agoo Forms | United States |
Agoo Forms
Agoo Forms, at agooforms.com, collects answers from people who never sign in. The maker decides what a form asks and why, Agoo processes the answers for them, and these protections are on for every form, at every level.
Mark a question sensitive (Ghana Card numbers are, from the start) and its answers are sealed when they arrive. They never appear in summaries or emails, and only those you allow can reveal one, each time recorded.
Choose how long answers are kept for a question, a form or the whole workspace. When the time is up they’re deleted, and a response in the bin goes after 30 days.
There is no password question, and every form says “Agoo Forms will never ask for your password or PIN”. Every form is checked as it’s published, and one that looks like it’s after passwords, PINs, one-time codes or card numbers waits for a person on Agoo’s safety team before anyone can answer it.
Every public form is guarded by a quiet robot check and limits on how often one connection can send, so floods are stopped without making real people solve puzzles.
Every form names who receives the answers. We never call a form “anonymous”: the page says plainly what the maker sees, and that Agoo keeps a scrambled form of a connection’s address for 30 days to stop abuse.
Every form carries Report this form. A person on Agoo’s safety team looks at each report and decides, the maker never learns who reported, and every decision can be appealed once.
Every form links to Your data, where people ask its maker for a copy of their answers, a correction or deletion, and Agoo follows up a request nobody answers in time. Makers export their responses or the whole workspace whenever they like.
You decide what your forms collect and why; Agoo processes it for you under the Agoo Forms terms. Your organisation’s forms follow the agreement it already has with Agoo.
Report a vulnerability
We welcome reports from security researchers and customers. Research in good faith that follows the rules here is welcome, and we won’t take legal action against it.
Email agoo@ardentafrica.com with “Security” in the subject. We acknowledge every report within 3 working days and keep you updated while we investigate and fix it. Our security.txt has the same details.
Agoo!
Join the organisations getting early access. We will set up your site, bring your staff list across and train your front desk.