Security

Safeguards that are actually in place, and how to report a vulnerability.

Draft for legal review — not a statement that AgentProof is legally compliant. Items marked PENDING need the operator's details or counsel's decision before launch.

Safeguards in place

Access keys and report retrieval tokens are stored only as SHA-256 hashes.

Database tables holding requests, payments and keys are reachable only by the service, not by browsers.

Hourly limits are enforced per key before any work.

Paid requests are protected against replay and double charging by caller-scoped idempotency and atomic payment records.

The public monitoring view shows redacted figures only.

What we do not claim

AgentProof has no security certification and has not had an independent audit.

Reporting a vulnerability

PENDING: security contact email. Please give us reasonable time to fix an issue before disclosure and do not access other people's data.