Agora.io is Fuel Cycle's 4th party real-time audio/video provider used in FC Qual. Vendor, security, and integration information below:
How Fuel Cycle Uses Agora
Fuel Cycle integrates Agora.io to power live audio and video capabilities in FC Qual, specifically for:
| Use Case | Description |
|---|---|
| In-Depth Interviews (IDIs) | 1:1 or small-group live video sessions between researchers and community members |
| Focus Groups | Multi-participant live video sessions with moderation |
| Real-Time Feedback Sessions | Facilitated sessions using live media to capture in-the-moment participant responses |
Important: No Data Storage
Fuel Cycle does not store any client data with Agora. All real-time communication is transient. No audio, video, or associated metadata is persisted or written to disk by Fuel Cycle or Agora. Agora functions as a media relay infrastructure layer only.
Domains to Whitelist
Client IT teams must whitelist the following domains to ensure FC Qual audio/video features function correctly. All domains are operated by Agora and are required for real-time media to route properly through Agora's global SD-RTN infrastructure.
Action Required Before Go-Live: Please review both reference guides and complete the whitelisting steps with your network or firewall team. Two configurations are especially important:
- Allow Agora's RTC and Signaling traffic to bypass SSL inspection on your VPN and firewall
- Permit both UDP and TCP traffic on Agora's media ports
| Feature/Service | Reference Guide |
|---|---|
| Video | https://docs.agora.io/en/realtime-media/video/reference/firewall#video-sdk-web |
| Signaling | https://docs.agora.io/en/realtime-media/video/reference/firewall#signaling-sdk-web |
Above is a standard setup step for video conferencing platforms generally. Tools like Zoom and Microsoft Teams require similar network configuration.
Security and Compliance Posture
| Category | Details |
|---|---|
| Certifications | SOC 2 Type II, ISO 27001 |
| Encryption in Transit | TLS (signaling), DTLS-SRTP (media) — industry-standard secure media transport |
| End-to-End Encryption | Supported — available for applicable session types |
| Data Residency | Agora operates a globally distributed SD-RTN; media traffic is routed ephemerally and not stored at any regional node |
| Data Processing Role | Infrastructure subprocessor (media relay only); Agora does not process, store, or access client research data |
| Fuel Cycle Due Diligence | Fuel Cycle performs ongoing due diligence on all subprocessors and 4th party vendors for security, privacy, and contractual compliance |
4th Party Classification & Client Guidance
From the perspective of Fuel Cycle's clients, Agora is classified as a 4th party vendor. Agora is engaged by Fuel Cycle, not directly by the client. Clients are not required to enter into any direct contractual relationship with Agora.
For Client IT Teams
Agora is a real-time media relay infrastructure provider used by Fuel Cycle's FC Qual product. It functions similarly to how a video conferencing platform routes calls: media is transmitted live and not retained. Your team's primary action item is to whitelist the domains listed in the Domains to Whitelist section above to ensure your employees can participate in live research sessions without network interruption.
Frequently Asked Questions
| Question | Answer |
|---|---|
| Is Agora a data processor for our data? | No. Agora functions as a media relay layer only. It does not store, process, or access client research data. All audio and video is transient. |
| Does Agora have access to our participants' PII? | No. Agora does not receive or handle PII. Session tokens are temporary and scoped to the live session only. |
| Is our media encrypted? | Yes. All media is encrypted in transit using DTLS-SRTP. Signaling is encrypted via TLS. |
| Why do we need UDP ports open? | Real-time audio/video performs best over UDP for low latency. If UDP is blocked, Agora will fall back to TCP 443, though this may affect quality. |
| Is Agora SOC 2 certified? | Yes. Agora holds both SOC 2 Type II and ISO 27001 certifications. Documentation is available upon request via your Fuel Cycle Account Director. |
| Do we need to sign a DPA with Agora directly? | No. Agora is Fuel Cycle's 4th party vendor. Fuel Cycle manages the vendor relationship and associated compliance obligations. |
| What if our policy prohibits 4th party video vendors? | Please contact your Fuel Cycle Account Director. We can provide additional documentation, a completed security questionnaire, or connect you with our InfoSec team for further review. |