Security
Letting agents in, without letting everything in
Opening your business to AI agents is a security decision before it's a product decision. This page describes exactly how the platform is defended — including what we deliberately don't do yet.
Claude · ChatGPT · Copilot · custom agents
│ MCP over HTTPS · Bearer token
▼
┌──────────────── Gateway ────────────────┐ ┌───── Auth layer (isolated) ─────┐
│ ✓ token introspection (RFC 7662) │◄───►│ OAuth 2.1 · PKCE · gated DCR │
│ ✓ audience binding per tenant │ │ own process · own storage · │
│ ✓ per-tool scopes · rate limits │ │ own keys · standard endpoints │
│ ✓ schema validation · SSRF allowlist │ └─────────────────────────────────┘
│ ✓ approval queue · kill switch │
└──────┬───────────────────────────────────┘
│ vault-injected credentials (agents never see them)
▼
Your website / API — unchanged
Controls
Defense in depth, by layer
Identity & tokens
OAuth 2.1 with mandatory PKCE (S256); dynamic client registration gated by initial access tokens — no anonymous agent registration. Access tokens are short-lived (10 min), audience-bound to a single tenant (RFC 8707), and revocable by jti. Refresh tokens rotate on every use.
Isolation of the auth layer
The authorization server runs as its own service with its own storage and key material. The gateway consumes it only via standard endpoints (introspection, metadata) — no shared code, no shared keys. Swap-out test: the gateway works identically against any OAuth 2.1 IdP.
Execution guards
Every invocation is validated against the tool's JSON Schema (unknown fields rejected), outbound requests only reach allowlisted origin hosts (private IP ranges and cross-host redirects blocked), and 15-second timeouts bound every call. Write tools support approval gating — closed by default.
Prompt-injection posture
Origin responses are wrapped in explicit data-not-instructions envelopes, scripts and styles are stripped from text output, and sizes are capped. This is a mitigation, not a guarantee — we say so, and a full sanitization pipeline is on the public roadmap.
Credentials vault
Your origin API keys are stored encrypted, injected server-side at execution time, and never appear in any agent-visible payload. We deliberately do not hold your end-users' third-party credentials — that capability ships only with an audited KMS/HSM story.
Observability & control
Every invocation is logged (who, what, argument hash, result code, latency) with tenant-facing audit export. Per-client rate limits, anomaly flags, and a tenant-level kill switch on your status page let you pause all agent access in one click — per-tool control comes from approval gating.
Data residency
PDPL-conscious by design
Hosted tenants
- Processing pinned to in-Kingdom regions
- We never train on your data — during analysis a third-party AI provider sees only your public site content
- TLS 1.2+ in transit, AES-256 at rest
- Data-processing agreement (Arabic/English)
Sovereign tier
- Gateway + auth run entirely inside your perimeter
- Air-gap-friendly, no phone-home
- Bring your own IdP and KMS
- Full audit-log export for your compliance team
Honesty section
What we don't claim
Are you SOC 2 / ISO 27001 certified?
Not yet — we're an early-stage product and won't pretend otherwise. The architecture is built to certification-friendly patterns (isolation, least privilege, audit logging), and SOC 2 Type I is on the roadmap once we exit early access. Sovereign customers can audit the deployment directly in the meantime.
Is prompt injection fully solved?
No one has fully solved it, including us. Our envelopes, stripping, and size caps raise the bar meaningfully — but the strongest protections remain scoped tokens and approval gates on anything destructive: even a manipulated agent cannot exceed the permissions you granted.
What reaches the AI provider during analysis?
Only your site's public content — pages and forms any browser can see — with a hard token cap per run, and analysis only runs when you trigger it. Credentials, tokens, and customer data never leave our systems. Agentify itself trains on nothing; the third-party model provider's retention policy applies to that public content until we pin zero-data-retention routing (on the roadmap) — we say it as it is.
Found a vulnerability?
Report it to security@agentify.example. We commit to acknowledgment within 48 hours, no legal action for good-faith research, and public credit if you want it.
Security review before you commit?
We'll walk your security team through the architecture, the threat model, and the audit trail — engineers included, slides optional.
Book a security review