Trust center
What we run today, what it stores, and how long we keep it. We'll update this page as each module ships.
What's live
This website, Emissar's public A2A agent, early access signup, the contact form, the public agent directory, and four free tools: the Agent Card validator, the A2A endpoint tester, the agent-readiness scanner and the AI agent signature check. The validator, the scanner, the llms.txt and Agent Card generators and a search of the directory can also be used from ChatGPT, through our MCP server at emissar.ai/mcp (what we receive from ChatGPT). A demo of Front Door runs at demo.frontdoor.emissar.ai with made-up data; no business uses Front Door in production yet. Three specifications are published for comment: Mandate, Receipt and Resolve. Resolve answers public lookups of domains at resolve.emissar.ai, from records EmissarBot found; businesses can't claim records yet. None of the product modules are in production; their status is on the product page.
Data we store
| Source | What | Where | Retention |
|---|---|---|---|
| Early access form | Name, email, company, role, which side you're on, which program, what you wrote, and the approximate country of the request | Cloudflare D1 | Deleted after 24 months, or sooner on request |
| Contact form | Topic, name, email, company, your message, and the approximate country of the request | Cloudflare D1 | Deleted after 24 months, or sooner on request |
| Messages to our A2A agent | Message content, task, context and message ids, and the agent's replies. While an early access request waits for more details, the details sent so far, which can include the calling agent's name or user agent | Cloudflare D1 | Deleted after 90 days |
| Early access sent over A2A | The same fields as the form, plus the calling agent's name, or its user agent if it gives no name | Cloudflare D1 | Deleted after 24 months, or sooner on request |
| Agent Card validator results | The target URL, the check results, and a copy of the Agent Card or AI Catalog that was fetched or pasted, under a random id that anyone with the link can open | Cloudflare Workers KV | Deleted automatically after 24 hours |
| Agent Card validator rate limit | The host name you asked us to check and when, to allow one card check and one AI Catalog check per host every 30 seconds | Cloudflare Workers KV | Deleted automatically about a minute after the check |
| A2A endpoint tester results | The card URL and endpoint URL that were tested, timings, and the check results for each step, under a random id that anyone with the link can open. Not the agent's replies: only their shape is recorded | Cloudflare Workers KV | Deleted automatically after 24 hours |
| A2A endpoint tester rate limit | The host names of the card and the endpoint and when they were tested, to allow one test per host every 30 seconds | Cloudflare Workers KV | Deleted automatically about a minute after the test |
| Agent-readiness scanner results | The site address, the score, and the findings for each file checked, under a random id that anyone with the link can open. Not the files themselves, a copy of the Agent Card, or security.txt contact addresses | Cloudflare Workers KV | Deleted automatically after 24 hours |
| Agent-readiness scanner rate limit | The host name you asked us to scan and when, to allow one scan per host every 30 seconds | Cloudflare Workers KV | Deleted automatically about a minute after the scan |
| AI agent signature check | For each request to a test link: the time, the method, the User-Agent it sent, its Signature-Agent header and the result of the signature check (the signing key's host and thumbprint, the algorithm and the covered components). Up to 20 requests per link, under a random id that anyone with the link can open. Not IP addresses, other headers or request bodies | Cloudflare D1 | Deleted automatically 24 hours after the link is created |
| Tools used from ChatGPT (emissar.ai/mcp) | What ChatGPT sends each tool: the domain, URL or Agent Card JSON to check, the details given for an llms.txt or Agent Card to generate, or the company name or domain to look up. The validator and the scanner store exactly what their rows above say; the generators and the directory search store nothing | Cloudflare Workers KV (validator and scanner results only) | As above for the validator and the scanner; nothing kept for the others |
| ChatGPT per-user rate limit | A one-way hash of the anonymized user id ChatGPT sends with each tool call (openai/subject), used only to allow 20 tool calls a minute per person; relied on only for requests from OpenAI's published addresses; other requests are counted per IP address, together with that address's use of the tools on this site. Nothing else ChatGPT sends (language, approximate location, browser details, conversation or organization ids) is read or kept | Cloudflare Workers Rate Limiting | Count held for about a minute; not stored by Emissar |
| Daily tool-call count | The number of tool calls through emissar.ai/mcp per UTC day, counted separately for ChatGPT and for other callers, to cap each total. No personal data | Cloudflare D1 | Deleted after 7 days |
| Front Door demo (demo.frontdoor.emissar.ai) | Messages sent to the demo agent, through its A2A endpoint or its MCP endpoint for personal assistants, including who a request is for when the assistant gives it (name, email, phone, account reference), the task and its states, the demo's replies (made-up data), the calling agent's declared name and user agent, when the agent signs its request, the result of checking that signature (the address of the agent's published key directory and the key's fingerprint), and our assessment of the calling agent (whether it signed, which known agent provider it belongs to, and whether it was allowed), kept with each task and as an exchange record | Cloudflare D1 and R2 | Tasks deleted after 90 days; exchange records deleted after 1 year |
| Front Door agent counts | For agents that sign their requests, daily counts per business and per agent, keyed by the address of the agent's key directory: tasks created, completed, or rejected by the limits the business set in Front Door, reviews approved or declined, and reports by the business. Counts only: no IP addresses, message content or names. A business's own list of agents it blocks or allows, by the same address | Cloudflare D1 | Counts deleted after 180 days; a business's list kept until it removes an entry |
| Front Door: ChatGPT users' requests | For requests from the network addresses OpenAI publishes for ChatGPT: that they came from ChatGPT, and a one-way keyed hash of the anonymized user id OpenAI sends (openai/subject), different for each business, so only that user can read, continue or cancel the request. Never given to the business or kept in exchange records. A hash of the same id limits how often one person can send requests | Cloudflare D1 (with the task); Cloudflare Workers Rate Limiting | With the task (90 days); the rate count for about a minute |
| Front Door update subscriptions | When a personal assistant asks to be told when a request changes: the web address it gives, an encrypted copy of the secret that signs the updates, and when each was sent and the kind of any failure (never the receiving server's answer). A one-way hash of an address that confirmed it wants the updates | Cloudflare D1 | Deleted 30 days after the subscription ends, and with its request; confirmed addresses after 24 hours |
| Front Door push notifications | When an agent calling over A2A asks to be sent each change of its task: the web address it gives, an encrypted copy of the token and credentials it asks us to send with each update (never shown back), and when each was sent and the kind of any failure (never the receiving server's answer) | Cloudflare D1 | Deleted 30 days after the task's updates end or the agent removes the setting, and with its task |
| Front Door receipts | When an agent asks for a signed receipt of a finished task (Emissar Receipt): the receipt, which holds identifiers, times, digests and signatures but no message content (who a request is for appears in it only as a salted digest), and an index of receipts: their identifiers and digests, the signing key's id and fingerprint, each receipt's place in the business's chain of receipts, and the conversation id while the receipt exists | Cloudflare R2 (receipts); Cloudflare D1 (index) | Receipts deleted 1 year after they are issued; index entries kept after that without the conversation id, so the chain can still be checked |
| Front Door mandates | For businesses that require a mandate for a request (Emissar Mandate; the demo doesn't): for each mandate accepted, its issuer and id, the time and the amount, and with the task and exchange record what was checked and what the mandate allowed, including the details about the person the agent chose to disclose. Never the mandate itself. Single-use challenges while they are open | Cloudflare D1 (and R2 with the exchange record) | Mandate uses deleted one day after the mandate expires; challenges when used or expired; the rest with the task (90 days) and the exchange record (1 year) |
| Front Door: PACT conversations | When a personal agent talks to a business over PACT (frontdoor.emissar.ai): the agent platform's address and its key's fingerprint, a one-way keyed hash of the platform and the user number it sends (never the number itself), what the conversation has collected so far (the service and its details, which can include who a request is for) and our replies, kept so a repeated message gets the same answer. Requests it sends are kept as tasks (Front Door demo row). The platform's published keys are held in memory for at most an hour, never stored | Cloudflare D1 | Deleted 90 days after the conversation's last message |
| Front Door: PACT personal agents | Agent platforms Front Door knows: their address, name and public keys, and whether they may connect. No personal data | Cloudflare D1 | Until an operator changes it |
| Resolve records (resolve.emissar.ai) | For domains whose website publishes an A2A Agent Card at the well-known address, as EmissarBot found it: the domain, the card's address, the level and method of verification, and when it was last seen. Public at lookup. No personal data | Cloudflare D1 | Kept until 35 days after the card was last seen; removed records deleted 24 months after removal |
| Resolve lookups | Not logged. To allow 60 lookups a minute per client, the rate limiter counts requests per IP address (per /64 network for IPv6) | Cloudflare Workers Rate Limiting | Count held for about a minute; not stored by Emissar |
| Resolve removal requests and reports | When someone asks through the contact form for a domain to be removed, or reports a wrong record: the domain, the kind of request, its status and decision, the contact form message's reference, and our reviewers' notes and handles. Never contact details. A domain removed at its owner's request is put, with the reason, on a list of domains never seeded again | Cloudflare D1 | References, notes and handles cleared 24 months after the report; the request deleted 24 months after it closes; that list kept until we remove an entry |
| EmissarBot crawler | For public websites that publish an A2A Agent Card or an AI Catalog: the document and facts from it (see /bot), including a card a site's AI Catalog lists at another address on the site when the well-known paths have none; facts from Agent Cards are also shown in the public agent directory at /directory. For sites without either, only totals. No personal data is sought or kept | Cloudflare D1 and R2 | Kept for adoption reports and the directory; removed within seven days of an opt-out or removal request |
| Every request | IP address and request details, processed by Cloudflare to deliver and protect the site | Cloudflare | Per Cloudflare's policies |
Deletion is automated: a scheduled job removes database records past these limits every day, and the tools' data in Workers KV is stored with an expiry, so it is deleted when its time is up. The tools don't write responses from the sites and agents they check to logs, and the validator doesn't store the key sets it fetches to check signatures. The site sets no advertising or tracking cookies.
Subprocessors
- Cloudflare, Inc.
- Hosting, content delivery, database (D1), key-value storage (Workers KV), security, and privacy-preserving analytics.
We'll add any new subprocessor here before it handles your data.
When you use our tools from ChatGPT, OpenAI, which operates ChatGPT, receives the tools' results to show them to you. It acts for you there, not as an Emissar subprocessor.
A business that uses Front Door can connect its own Zendesk account. A request that needs a person at that business is then also written, with the exchange, as a ticket in that business's Zendesk, and the person's decision comes back to Front Door. Zendesk acts for that business, not as an Emissar subprocessor. No business has connected one yet.
Certifications
Emissar has no third-party security certifications yet. When an audit starts, we'll list it here with its scope and dates.
Security practices in place
- The site and agent are served only over HTTPS.
- Form and agent inputs are validated, size-limited, and stored with parameterized queries.
- The public agent can't list tasks, so one caller can't read another caller's requests without the task id.
- The public agent answers only from published site content.
- The free tools fetch only public https hosts, refuse IP addresses and local names, re-check every redirect, count a redirect to another site against that site's 30-second limit, and limit each request to 5 seconds and 256 KB. The endpoint tester sends agents only its own fixed test calls, never text a visitor supplies, and only to an endpoint on the tested card's own domain.
- Our MCP server for ChatGPT offers only tools that read or draft, never ones that change anything: they run the same code, with the same limits, as the tools on this site. It refuses requests sent from other websites' pages, allows each ChatGPT user 20 tool calls a minute, and caps the daily totals for ChatGPT and for other callers separately.
- Requests from our crawler, EmissarBot, are signed with an Emissar key (Web Bot Auth, HTTP Message Signatures per RFC 9421), so a site can check they came from us. The free tools' requests aren't signed, because anyone can point them at any site. The public key is at
/.well-known/http-message-signatures-directory; how to check a signature. - Our Agent Card is signed (JSON Web Signature, as A2A v1.0 section 8.4 describes) with a separate key, published at
/.well-known/jwks.json, so an agent can check the card wasn't changed after we published it.
Report a security issue
Send a report through our contact form. Our security.txt has the details. Good-faith research that follows our acceptable use policy is welcome.