Handing real work to an AI agent means trusting the company that runs it. Your documents, your connected systems and your team's conversations all live with us. That trust should rest on more than our word, so we had our security independently assessed.
Care Hero Pte. Ltd., the company behind Agent Hero, now holds the Cyber Security Agency of Singapore's Cyber Essentials (2025) for HIMS Vendors certification. Certificate CEM-2026-252 was issued by ISOCert Pte Ltd on 26 August 2026 and is valid until 25 August 2028.
What Cyber Essentials is
The Cyber Security Agency of Singapore (CSA) runs two cybersecurity marks for organisations. Cyber Trust is risk-based, for organisations with a higher risk profile. Cyber Essentials sets the baseline: the controls that protect an organisation from the most common cyberattacks.
Those controls are the basics every business has to get right:
- Assets. Staff know how to be the first line of defence. We know what hardware, software and data we have, where it is, and how it's protected.
- Protection. Defence against viruses and malware, controlled access to data and services, and secure settings on every device and system.
- Updates. Software on devices and systems is kept up to date.
- Backups. Essential data is backed up and stored offline, away from the systems it protects.
- Incident response. We are ready to detect, respond to and recover from a security incident.
Why the HIMS edition
There is more than one edition of Cyber Essentials. We took the one for HIMS vendors: companies whose software handles health information. CSA built it with Singapore's Ministry of Health, and it adds requirements on top of the baseline mark.
Some of our customers work in healthcare, so we held ourselves to that edition. The same controls protect every workspace, whatever your industry.
How we got here
Certification has two stages.
- Self-assessment. We worked through CSA's guided self-assessment and recorded how we meet each requirement. Ours is dated 7 August 2026.
- Independent assessment. ISOCert, a certification body appointed by CSA, assessed it against our documents and evidence. To be certified, an organisation has to meet every requirement. Recommendations are optional; requirements are not.
What the certificate covers
The certified scope is the production and development environment for our SaaS service. That's where your workspace runs, and where we build Agent Hero.
What it means for your workspace
Certification checks the controls behind the product. Among them:
- multi-factor authentication on administrative access
- encryption of data in transit
- each organisation's workspace kept isolated from every other
- logging
- up-to-date antivirus protection and regular patching of systems and software
- secure erasure of storage before it is disposed of
- credential exposure checks, device vulnerability assessments and security hardening
- regular security reviews and independent penetration testing
They sit underneath the boundaries you see in the product. Agents work in a sandbox and reach only the documents and connections you give them. Changes wait for your approval unless you choose otherwise. Connected systems sign in on the provider's own page, so Agent Hero never holds your password.
What a certificate doesn't do
No certificate makes a system unbreakable, and we won't pretend otherwise. Cyber Essentials is a baseline we have to keep meeting. It lasts two years, after which we certify again. Security work doesn't stop between assessments.
Read more
- Safety: the boundaries your agents run inside, in plain language.
- Privacy policy: how we collect, use and protect personal data, including our security measures.
Questions about our security? Write to enquiry@agentheroai.com.
People change. The know-how stays.
