Security
What we do today — and what we don't claim.
This page describes the security measures actually in place at AgentPro. We prefer a short, verifiable list over generic promises: every item below corresponds to a mechanism that is live in our production code or infrastructure.
Certifications and attestations
SOC 2 / ISO 27001: not certified to date.
We currently hold no formal security certification. An attestation programme is under consideration; we will update this page as soon as a concrete timeline is set. Until then, we transparently document below the measures that are actually deployed.
Measures in production
The following measures are live in production and verified in our code.
Encryption in transit
- TLS everywhere: all HTTP traffic is force-redirected to HTTPS.
- HSTS enabled for 1 year, with includeSubDomains and preload.
- TLS 1.2 and 1.3 only at our edge — older versions are refused.
- Encrypted connections to the database (sslmode=require) and to Redis (rediss).
Sessions and accounts
- JWT tokens stored in HttpOnly, Secure, SameSite cookies — never accessible to JavaScript.
- Refresh tokens rotated on every use, with a revocation blacklist.
- TOTP two-factor authentication available, with the secret encrypted in the database.
- 2FA mandatory for all administrator accounts.
- Per-device session management with remote revocation — no IP address storage (data minimisation).
Abuse prevention
- Per-IP rate limiting (30 requests/minute) on all authentication endpoints.
- Dedicated per-service quotas to curb abusive usage.
HTTP headers and browser protections
- Content-Security-Policy with nonces, no unsafe-inline scripts.
- X-Frame-Options DENY and frame-ancestors 'none' against clickjacking.
- X-Content-Type-Options nosniff.
- Restrictive Referrer-Policy and Permissions-Policy.
Data protection
- Player names pseudonymised before any AI processing.
- Sensitive secrets (e.g. TOTP secrets) encrypted in the database.
- Personal data redacted from logs: passwords, tokens, emails and licence numbers are masked.
- Retention periods defined table by table.
- Data export and deletion (DSAR) fully operational.
Development pipeline
- Blocking security CI on every push: CVE audit of Python and npm dependencies.
- Static analysis of the backend code (bandit).
- Secret scanning (TruffleHog) across the entire git history.
- Automated anti-IDOR tests: cross-account access checks.
- Accessibility CI and Lighthouse performance budgets.
Hosting
- Backend on DigitalOcean App Platform, LON1 region (London, United Kingdom); files on DigitalOcean Spaces.
- Frontend hosted on Vercel.
- DNS and proxy provided by Cloudflare.
AI crawler policy
We distinguish bots that help users find our content (search, retrieval) from those that harvest the web to train models. The principle: our public content remains discoverable by AI assistants, but we refuse third-party model training on our content.
| Bot | Purpose | Status |
|---|---|---|
| ClaudeBot | Search / retrieval (Anthropic) | Allowed |
| OAI-SearchBot / ChatGPT-User | On-demand retrieval (OpenAI) | Allowed |
| GPTBot | Model training (OpenAI) | Blocked |
| Google-Extended | Model training (Google Gemini) | Blocked |
| CCBot | Common Crawl corpus (training) | Blocked |
This policy has been enforced in our robots.txt file since 26 July 2026.
Report a vulnerability
Think you have found a security flaw? Write to us: good-faith reports are welcome and reviewed as a priority.
We commit to acknowledging your report and keeping you informed of how it is handled within a reasonable time.
We do not run a bug bounty programme to date: we do not promise any financial reward.