Trust centre

Generated from the running system at deploy time, not written by hand. Each section names its source and the whole page carries a content hash.

Generated 2026-10-27 12:46:15 UTCsha256 f38f8c72fc2a78d8…JSON

What is real in this demo build

Real: the protocol surfaces (UCP profile, ACP and Merchant Center feeds, JSON-LD, llms.txt, MCP server, hand-off tokens, Web Bot Auth) run for real against a synthetic catalogue.
Real: the hash-chained evidence store, tenant isolation checks, policy evaluation and the controls listed on these pages run in this process.
Simulated: every business, person and licence number is fictional (licence numbers start with DEMO-). Partner platforms, PSPs and CRMs are deterministic stand-ins; no partner credential exists in this build.
Not present: no AI or LLM calls of any kind and no outbound network calls from the server, except the readiness scanner when an operator enables it.

Sections

Architecture attestation

What AGORA's architecture guarantees about payment data, the evidence for each control, and live checks run when this page was generated.

View

TPSP responsibility matrix

Who is responsible for each payment-security requirement: AGORA, the business, or its PSP.

View

Data residency

Where tenant data lives, which data classes never leave their region, and how an exception is approved.

View

Sub-processors

Third parties that process customer data on AGORA's behalf, generated from the deployed connectors.

View

AI systems

Every AI system AGORA provides or deploys, with how people are told and how output is marked.

View

SOC 2 status

The SOC 2 Type II control map to the running system, and where the observation window stands.

View

Security and vulnerability disclosure

How to report a vulnerability, and the controls this build implements.

View

Hard rules

The engineering rules every change is held to, read from the repository's guardrails file when this page was generated.

Rule	Requirement	Enforcement
R1	No PAN, CVV or full payment credential enters any AGORA system, log or trace.	Payment fields are PSP token references only (`pm_demo_...`, `psp_ref`). Schemas in `protocols/` reject PAN-shaped strings. `server/src/modules/commerce/pan.ts` rejects them at the adapter. `scripts/scan-pan.mjs` runs in CI.
R2	The merchant is always merchant of record; AGORA never confirms a payment.	No code path marks an order paid without a PSP confirmation reference. Checkout completion requires `psp_ref`.
R3	Every inbound agent request passes trust-edge before any adapter or MCP tool.	Protocol routes are registered behind the trust-edge middleware (`server/src/protocols/trustEdge.ts`). Tests assert that direct calls are rejected.
R4	Mandate, consent and disclosure records are append-only and hash-chained.	The evidence store has no update or delete path. `chain_hash = SHA-256(prev_hash, payload_hash, kind, verified_at)`. Verification is a real SHA-256 check (Trust page: "Verify chain").
R5	Lab agents declare identity, honour robots.txt and terms, never evade defences, and never purchase on third-party sites without test credentials and merchant consent.	The lab runner signs with Web Bot Auth (RFC 9421) and declares its user agent. Purchase actions require `consent_ref` (see `missions/`, `policies/trust-edge/default.cedar`).
R6	Generated assets cannot contain prohibited terms or unapproved claims.	A kernel-check gate runs in the content pipeline. Prohibited claims are listed per regulator in `packs/<id>/kernel.yaml`. Publish is blocked on failure.
R7	Synthetic outputs are population-level only.	There is no per-persona output endpoint. The report generator refuses N below the threshold.
R8	Tenant isolation everywhere.	`tenant_id` is on every record, event and key. Cross-tenant tests are in `server/test/`.
R9	Earned-signal workflows log a disclosure for every outbound interaction and block fabricated reviews.	Playbook schema: `earned.*` steps need `disclosure_required: true`. Review ingestion requires a verified-order link.
R10	Industry neutrality. No service, adapter, projector, runner, prompt, mart or console screen may assume an industry, an offering kind, a conversion type, a currency, a locale or a jurisdiction. Behaviour is parameterised by the tenant's packs; the generic pack (`packs/generic`) makes every module work for an unknown business.	`scripts/check-generality.mjs` (static scan: pack ids, offering-kind literals, currency/locale/jurisdiction codes outside `/packs`, `/policies`, `/missions`, fixtures and the pack loader), `scripts/copy-lint.mjs` (neutral vocabulary in shared UI and document templates), the industry fixture matrix (Anybiz LLC + six "no pack" businesses) and pack CI — the `generality` CI job. The conversion × kind matrix is data (`shared/src/generality.ts`); `—` cells return `not_applicable`.
R11	AI disclosure. Every AGORA-operated agent that interacts with a person discloses that it is automated; generated content carries machine-readable AI-content marking.	Runners inject the declared UA and `AI_DISCLOSURE_TEXT` (`server/src/modules/compliance/api.ts`) and record `ai.disclosure.recorded`; the content pipeline cannot publish without a marking manifest; the AI-system inventory is served at `GET /v1/trust/ai-systems`.
R12	Jurisdiction gating. Offerings in restricted categories are never surfaced, compared, routed or marketed to a user whose resolved jurisdiction is not permitted; unresolved jurisdiction denies.	`jurisdictionGate()` is evaluated in projectors, adapters, MCP tools, lab, visibility, lifecycle and ads; the "UAE geo-fence" test is a release blocker (`compliance` CI job). Flag `policy.jurisdiction.unresolved=deny` is immutable for restricted categories.
R13	Self-serve by default. Every tenant/merchant operation available to AGORA staff is available to the tenant through console or API.	The API-only E2E test creates a tenant, merchant, connection, projections, lab plan, invoice preview and deletion through the public API; break-glass is read-only.
R14	Budgeted intelligence. Every model call, lab run, visibility sample and study is attributed to a tenant and a task, counted against a budget with a hard stop, and visible in the console.	llm-gateway refuses calls without `tenant_id`/`task_id`; a breach raises `budget.exceeded` and halts the plan; billing meters reconcile to gateway usage within 1%.