Security
Verifiable claims, not just promises.
AgentSmack's evidence is cryptographically signed, the verification math is open, and the audit trail is built to survive a SOC 2 walk-through. Every claim on this page has a public artifact you can inspect.
How signature verification works
- 1
Workspace generates an Ed25519 key pair.
The private key never leaves your workspace. Public key is served at a stable URL: /marketplace/<slug>/key.pub.
- 2
Card payload is canonicalised.
Keys are sorted lexicographically. Tags are lowercased + sorted. Timestamps are ISO-8601 UTC. A trailing newline is appended. The result is UTF-8 bytes.
- 3
Ed25519 signs the canonical bytes.
Ed25519 is deterministic by construction — same private key + same payload yields byte-identical signatures. The signature is stored alongside the card as detached hex.
- 4
Verifier reconstructs + checks offline.
Download pack.json, re-run the canonicalisation, fetch key.pub once, and call ed25519.verify(). No round-trip to AgentSmack required.
Public keys + sample governance pack
# Every published card exposes these three URLs:
GET https://agentsmack.com/marketplace/<slug>/key.pub
GET https://agentsmack.com/marketplace/<slug>/pack.json
GET https://agentsmack.com/marketplace/<slug>/pack.md
# pack.json contains the canonical payload + signature hex.
# pack.md is the human-readable governance pack.
# key.pub is the Ed25519 public key in standard hex.
Browse the live marketplace to grab a real sample pack.
Compliance controls mapping
| Control | Promise |
|---|---|
| SOC 2 CC7.2 | Every analysis run is an EchoAtlas event with a correlation ID. Findings and probe outputs are immutable on the audit chain. |
| SOC 2 CC6.1 | Operator authentication is passkey-first. Step-up assertions gate sensitive surfaces. API keys are scoped per workspace. |
| ISO 27001 A.5.27 | Findings + probe responses are exportable as a versioned governance pack with a Merkle root so a downstream auditor can replay. |
| GDPR Art.17 | Deletion is a first-class operation. It removes the submission, artifacts, findings, probe history, and audit projection — atomically. |
| HIPAA §164.312(b) | Audit trail is append-only with periodic Merkle anchoring. Tamper detection runs on a schedule and surfaces drift events. |
Responsible disclosure
Found a vulnerability? Email security@agentsmack.com with reproduction steps. We acknowledge within 48 hours and keep you in the loop until the fix ships.
We do not pay bounties yet. We do publicly credit researchers who file good reports — and we'll fold the technique into the Underground probe library with attribution.
Need a security review or DPA?
We ship questionnaires, DPAs, and SOC 2 walk-through bundles on request.