Trust Center
How Agent Verify handles your code and data
Plain answers for security reviews. If something here is unclear or you need a security questionnaire filled in, email hello@aiblockchainventures.com.
Your code
- We do not store the raw agent code you submit. It is analyzed and then discarded.
- We store the scan results — verdict, score, findings and file name — so your report history works.
- You can delete any report from your dashboard. To delete your account and all its data, email hello@aiblockchainventures.com.
- Pull-request checks read your repository files through the GitHub App permissions you approve, and keep only the results.
Encryption
- All traffic to the website and API uses HTTPS (TLS).
- GitLab/Bitbucket access tokens and the headers for prompt-injection test targets are encrypted at rest with AES-GCM; the key is held as a Cloudflare secret, not in the database.
- Payments go through Stripe Checkout. Card details never reach Agent Verify.
Access and accounts
- Sign-in is handled by Firebase Authentication (email or Google).
- Team plans have owners and members; workspaces have roles and an audit log of security actions.
- API keys are created in the dashboard; making a new key turns the old one off.
Report integrity
- Reports can be signed so anyone can check they were issued by Agent Verify and have not been changed. Signing key →
- A signature proves who issued a report and that it is unaltered — not that every finding is complete.
Safe testing
- Prompt-injection tests are only sent to an agent after you prove you own its host (a token file at /.well-known/agentverify.txt).
- Tests are limited to one run at a time and a few runs per day.
AI answers (“Ask”)
- Search in the Ask box runs in your browser.
- When you ask the AI, your question and the matching help text (and, if you are signed in, matching findings from your own scans) are sent to Cloudflare Workers AI to write the answer.
- We keep only a daily count of questions for limits — not the questions themselves.
Where it runs
- API: Cloudflare Workers, with a Cloudflare D1 database for billing, plans and settings.
- Accounts and reports: Google Firebase (Authentication and Firestore).
- Payments: Stripe. Email (optional alerts and weekly summary): Resend.
Certifications
Agent Verify does not hold a SOC 2 or ISO 27001 certification yet. Its compliance features help you collect evidence for EU AI Act, ISO/IEC 42001, SOC 2 and NIST reviews of your agents; that evidence is not a certification of Agent Verify or of your product.
Found a security issue? Please email hello@aiblockchainventures.com — we reply to every report. See also the privacy policy and system status.