Security

• All traffic is served over HTTPS with HSTS (max-age=63072000, two years).
• X-Content-Type-Options: nosniff — no MIME sniffing.
• X-Frame-Options: SAMEORIGIN — the site cannot be framed by another origin (clickjacking). The one exception is /door/[slug]/embed, the public chat a vendor embeds on its own site (no signed-in action on it), which explicitly sets Content-Security-Policy: frame-ancestors * for that path only.
• Referrer-Policy: strict-origin-when-cross-origin — full URLs are not leaked to third-party sites.
• Permissions-Policy: camera, microphone, geolocation and the payment API are all denied.
• Content-Security-Policy is enforced (with Report-Only still recorded alongside). script-src is limited to our origin and the analytics hosts, but inline scripts remain allowed: the nonce pass is a staged migration still in progress, and we list that as not yet done.

• The database is Supabase (PostgreSQL) in the Tokyo region, ap-northeast-1; hosting is Vercel (US).
• Row Level Security is enabled on every table.
• The waitlist table accepts INSERT from the anonymous key and nothing else — it cannot be read back with that key.
• Door, request and billing tables are reachable only with the service-role key, which exists only on the server; the browser cannot query them directly. The anonymous key and the logged-in user role have had their table privileges on these tables revoked outright, so there is no RLS policy to get wrong and no grant to lean on.
• Accounts use Supabase Auth, and the session is kept in a cookie.

• Disclosure gate: a door's agent answers only from sources whoever manages that door explicitly approved. Revoking a source immediately invalidates cached answers derived from it, not just future ones.
• Domain ownership: whoever manages a door can prove they control its website by placing a DNS TXT record (_agentdoor.<host>) or a meta tag in the homepage's <head>; the homepage is fetched through the crawler's SSRF guard. A door that has not passed this check is labelled "Unofficial" on its public page and does not accept meeting requests. The check confirms control of the website only, not the door's name or description.
• Answers carry the sources they drew on, and a question the approved sources cannot answer returns a refusal rather than a guess.
• The site-ingestion crawler is SSRF-guarded: https/http only, standard ports only, IP literals and localhost / .local / .internal rejected, every hostname resolved before connecting and refused when it points at a private, loopback or link-local address (cloud metadata included), and redirects followed one hop at a time with the same checks on each hop.
• Page count, payload size and request timeouts are all capped during ingestion.
• Vendor-configured notification (CRM / Slack webhook) URLs are https only, pass the crawler's destination check on every delivery (hostname resolved, private / loopback / link-local refused), and every body is signed with the door's own secret (HMAC-SHA256 in the X-AgentDoor-Signature header).
• A vendor can issue an answer-only token so their own AI agent answers the questions their door could not. It can read that door's open questions and answer them, nothing else (no publishing, source approval or settings). Only its hash is stored and the token is shown once. Unless the vendor opts into auto-approve, an agent's answer is stored as an unapproved source: the door's public chat never uses it, it affects only the one request that asked, and that buyer sees it labelled as an unconfirmed answer from the vendor's AI agent.
• The agent entrance (OpenAPI document, MCP server, /.well-known/ai-catalog.json) goes through the same API handlers as the website. Rate limits, per-door monthly answer quotas and login rules are identical; there is no agent-only shortcut. This entrance will be available at launch.

The processors that handle personal data on our behalf:

• Changes reach production through an automated pipeline; only commits that pass type-checking and a full build are promoted.
• Dependency vulnerabilities are picked up by automated scanning and scheduled updates.
• The database (Supabase) runs on the Pro plan, which takes automatic daily backups; the last 7 days of them are retrievable (Supabase's published spec, checked 2026-08-25).
• We hold no third-party security certification (SOC 2, ISO 27001 or equivalent).
• No third-party penetration test has been performed.
• There is no 24/7 monitoring rota and no formal incident-response SLA yet.
• Point-in-Time Recovery — the paid add-on that restores to any chosen second — is not enabled. Recovery granularity is therefore one day, not one transaction.
• No restore drill has been performed. Backups being taken and a restore actually working are two different facts, and only the first is established.
• Compliance documents vendors upload (PDF / Excel / Word) are not scanned for malware. We accept only files whose extension matches their leading bytes, store them privately and serve them through 60-second links, but we do not inspect their contents. Check downloaded files in your own environment.

Please report vulnerabilities to contact@agent-door.com, with reproduction steps if you have them. There is no bug bounty at this stage, but every report gets a reply and a status update on the fix, and we are glad to agree a disclosure timeline with you.

robots.txt explicitly allows the following AI answer-engine and search-engine crawlers by name. This covers public pages only; dashboards and manage screens stay noindex, and pages behind the launch gate still return 404.

• AI answer engines: OAI-SearchBot, ChatGPT-User, GPTBot, ClaudeBot, Claude-SearchBot, Claude-User, PerplexityBot, Perplexity-User, Google-Extended
• Search engines: Googlebot, Bingbot, Applebot, Applebot-Extended, DuckDuckBot, CCBot