Security

27 security checks on every listing

Trust Agent verifies provenance, declared permissions, real runtime behavior, and enterprise fit before a role, skill, or agent is promoted to buyers.

Audit-first trust modelProvenance awareEnterprise policy controls

Trust output

Score + risk + badges

MCP extension coverage

+12 MCP checks

Execution posture

Runs on customer infrastructure

5-stage audit pipeline

Every listing passes through a structured, multi-stage audit pipeline before it reaches buyers.

Intake and source verification

Source provenance, commit history, attribution, manifest schema validation.

Static analysis and dependency audit

Code scanning for unsafe patterns, CVE detection, typosquatting, pinning hygiene.

Prompt safety and permission fidelity

Prompt abuse detection, exfiltration checks, declared vs observed permission alignment.

Runtime sandbox execution

Containerized execution capturing network, file, and process behavior evidence.

Human analyst review and scoring

Expert review, trust score assignment, badge tier, and risk narrative publication.

Source integrity

6 checks

Provenance, attribution, commit history, and version drift posture.

Manifest validation

5 checks

Required fields, entrypoints, runtimes, permissions, and supported tools.

Static analysis

8 checks

Shell misuse, unsafe eval, destructive patterns, obfuscation, and secret access signals.

Dependencies

6 checks

Known CVEs, malicious package heuristics, typosquatting, and pinning hygiene.

Prompt safety

5 checks

Prompt abuse, exfiltration instructions, unsafe escalation, and hidden policy bypass.

Permission fidelity

6 checks

Declared versus observed network, file, and process behavior.

Runtime sandbox

7 checks

Containerized execution, activity capture, network requests, and file-system behavior.

Behavior verification

4 checks

Claim-vs-behavior truthfulness and out-of-scope execution checks.

GDPR compliance

Trust Agent is designed for GDPR compliance. Primary data is stored in the EU (AWS eu-west-2, London region). We honor all data subject rights including right to access, rectification, and erasure.

Lawful basis assessment for every data processing activity

Data residency enforcement - all primary data stored in EU (eu-west-2)

Right to erasure - full account and data deletion within 30 days on request

Data minimization - we only collect what is strictly necessary

Privacy by design - privacy impact assessments on every new feature

Data Processing Agreements (DPAs) available for enterprise customers

SOC 2 alignment

Our architecture and operational controls align with SOC 2 Type II trust service criteria. Trust Agent does not currently hold SOC 2 certification but operates to these standards.

Role-based access controls with least-privilege enforcement

Comprehensive audit logging on all system access and changes

AES-256 encryption at rest for all stored data

TLS 1.3 encryption in transit for all API and web traffic

Annual penetration testing by independent third parties

Incident response plan with documented escalation procedures

Data security

Encryption at rest

All data at rest is encrypted using AES-256. Database volumes, backups, and object storage are encrypted by default with managed keys.

Encryption in transit

All traffic is encrypted with TLS 1.3. HSTS is enforced across all endpoints. API traffic, webhooks, and web requests all use HTTPS exclusively.

No message storage

Trust Agent does not store user messages, prompts, or agent conversation content. Audit data captures behavior evidence only - never raw user input.

systemPrompt protection

Creator system prompts and orchestration logic are treated as protected intellectual property. They are never exposed in any API response, audit report, trust badge, or buyer-facing evidence output.

API response isolation

All API endpoints are filtered to exclude system prompt content. Audit reports reference behavior evidence, not raw prompt source.

Seller IP protection

Trust Agent publishes buyer-safe evidence and analyst narratives without exposing raw creator prompts, manifests, or secure role orchestration logic.

Trust and verification model

Nine-layer audit stack

Source integrity, manifests, static code analysis, dependency hygiene, prompt safety, permission fidelity, runtime sandboxing, behavior verification, and drift handling.

SOC 2-friendly architecture

Role-based access controls, audit exports, wallet trails, protected prompt IP, and company-aware gateway execution. Trust Agent does not claim SOC 2 certification.

Customer-owned execution

Agent logic is packaged, audited, and delivered with protected invocation workflows. Roles and skills execute in the customer environment, not on Trust Agent servers.

Badge tier model

Platinum

95-100

Gold

85-94

Silver

70-84

Basic

<70

Infrastructure

Cloud provider

AWS eu-west-2 (London). All primary infrastructure, compute, and storage reside within the EU.

Application hosting

Render managed platform with automated deployments, health checks, and zero-downtime releases.

Database

Neon PostgreSQL with automated backups, point-in-time recovery, and connection pooling. All connections encrypted.

Runtime behavior and drift controls

Sandbox evidence

Docker-based jobs capture commands, network requests, and file activity so buyers can see what was actually observed.

Source drift

If indexed source changes after the audit, the verification posture degrades until a new scan and analyst pass complete.

MCP-specific protection layer

12 additional MCP checks

Endpoint exposure, transport constraints, undeclared tool bridges, external process escalation, and safety envelope validation.

Protected seller IP

Trust Agent publishes buyer-safe evidence and analyst narratives without exposing raw creator prompts, manifests, or secure role orchestration logic.

Standards and certifications alignment

GDPR

Compliant

EU data protection regulation

SOC 2 Type II

Aligned

Trust service criteria alignment

OWASP Top 10

Aligned

Web application security standard

ISO 27001

In progress

Information security management

Responsible disclosure

We take security vulnerabilities seriously and appreciate responsible disclosure from the security community. If you discover a vulnerability, please report it to us so we can address it promptly.

How to report

Email security@trust-agent.ai with a description of the vulnerability, steps to reproduce, and any supporting evidence. We aim to acknowledge reports within 48 hours.

Our commitment

- Acknowledge receipt within 48 hours
- Provide an initial assessment within 5 business days
- Work with you to understand and resolve the issue
- Credit researchers who follow responsible disclosure
- No legal action against good-faith security research

Security contact

security@trust-agent.ai