Use Agent Now
Security

Security and compliance, plainly stated.

Where we stand today, where we're going, and who to talk to. The decision-maker view of /privacy-design — same architecture, framed for the people signing off.

security@useagent.now · 48h acknowledgmentUntil the first SOC 2 Type II report is public, privacy claims defer to /privacy-design.
Certifications and audits

Four frameworks. Four honest statuses.

One row for each framework that matters to a procurement review, with the real status — not a logo wall. “In progress” means in progress; “delegated” means a named vendor carries that scope.

FrameworkStatusScopeNotes
SOC 2 Type IIin progressSecurity, Confidentiality, PrivacyAudit partner published on this page at kick-off. First report by end of 2026 — executive summary public, full report under NDA.
GDPR (EU)honored globallyData subject rightsAccess, rectification, erasure, and portability — email security@useagent.now. Applied globally, not just for EU residents.
CCPA (California)honored globallyConsumer privacy rightsSame rights as GDPR, applied globally. No sale or sharing to opt out of — we do not sell or share.
PCI DSSdelegatedCard data handlingStripe is the card processor. useagent.now never stores Primary Account Numbers or full card details on its own infrastructure.
Until the first SOC 2 Type II report is public, the canonical source for every privacy claim is the privacy design document. The audit partner and kick-off date will be posted here the day the engagement begins.
Where the data lives

We don't promise “data never leaves region X.” We publish where it actually lives.

A hard geo-gate would help no one whose work crosses borders, and would become a product tax on every future change. Here is the map procurement asks for. The extended version with replicas and notes sits on the privacy design page.

  • Account, billing, wallet
    AWS us-east-1 (Virginia)
  • Read replicas for latency
    AWS Tokyo + Singapore
  • BYO credentials
    Dedicated KMS in us-east-1, isolated IAM boundary
  • Edge (stateless)
    East Asia · Europe · North America · CN mirror
  • Audit logs
    AWS us-east-1 + cold backup us-west-2
Full residency table with replicas and rationale lives at /privacy-design#residency.
Account hardening

Four controls. Three things we refuse to build.

Account security is a series of narrow decisions. Each of the four controls is one decision. The three items on the right are the same kind of decision — made against adding them.

What we do
The four controls in force today.
  • Sign-in
    GitHub OAuth as the primary identity. Optional email magic link as a fallback when GitHub is unreachable.
  • Two-factor
    Inherited from the GitHub account — if your GitHub has 2FA on, your useagent.now sign-in does too. No separate setting to get wrong.
  • Credential rotation
    Quarterly KMS rotation on BYO tokens. Envelope keys rotate on the same cadence; plaintext is never exported.
  • Session
    30-day rolling session. Forced re-authentication on suspicious change — new country, new device class, or new IP block outside the recent tail.
What we refuse
Named, so there's nothing to wonder about.
  • Password login
    Passwords are a net loss when GitHub OAuth already exists. One less thing to leak, reset, or phish.
  • SMS 2FA
    SIM swaps and number-porting attacks are real. GitHub's TOTP or security-key factor is stronger and already in place.
  • Hardware-key binding on our side
    We do not enroll or store hardware keys directly. Use hardware keys on your GitHub account; the signal flows through OAuth.
Incident response

Four clocks. One ladder. No spin.

When something breaks, these four deadlines govern what we do and when. They are not aspirational — missing one is itself an incident.

  1. 4 hours
    Confirm, war room, freeze.

    The affected data flow is frozen. An internal war room opens. The clock on the rest of the ladder starts here.

  2. 72 hours
    Notify affected users.

    Email from security@useagent.now with the scope, the impact, and what the user needs to do. Nothing dressed up, nothing buried.

  3. 7 days
    Public statement on /status.

    One page per incident. Dated, signed, permanent. Linked from the changelog and the transparency report.

  4. 30 days
    Full postmortem.

    Root cause, contributing factors, fix, and a concrete preventive action. Posted on /status alongside the incident page.

Quarterly transparency report
Incidents, SLA adherence, data subject request volume, supply mix.

Published every quarter. Covers the last three months of incidents and whether the four clocks above were hit, plus data subject request volume and supply transparency metrics. No quarter is skipped — an empty quarter is reported empty.

Next disclosure: end of current quarter.
Responsible disclosure

Send it to us first. We answer in 48 hours.

One inbox, one clock. The rules below are the contract between the researcher and the engineering team — nothing hidden behind a form.

The rules
Coordinated disclosure, no gotchas.
Channel
security@useagent.now
Acknowledgment SLA
48 hours
Coordinated window
90 days — extendable if the researcher wants more
After the fix
Added to the hall of fame on /security/acknowledgments
PGP fingerprint and canonical contact live in /.well-known/security.txt (RFC 9116).
Bounty policy
Recognition over cash.
  • No paid bounty

    We don't run a cash bounty program. Paying for vulnerabilities invites noise and sets incentives we're not ready to manage well.

  • Hall of fame and swag

    Confirmed reports get a permanent credit on the acknowledgments page and a package of useagent.now swag. Researchers keep full attribution.

Report an issue
security@useagent.now
Contact

Three mailboxes, routed by intent.

Use the address that matches the request. Everything lands with a human on the engineering, legal, or commercial side — not a shared queue that fans out.

Companion document

The developer's view lives at /privacy-design.

This page is for the people signing off. The data flow, the three boundaries where content is touched, and the full persistence list live on the privacy design page — same architecture, different audience.