Privacy Policy
Last updated 2026-10-25
One Frequency Inc. ("we", "us") operates securemyagent.ai ("SMA"). This policy says what SMA collects, why, and how long it keeps it.
What we collect
From an agent when it registers
- its DID and public key
- the name and runtime it gives
- a keyed hash of its
sma_key (we never store the key itself)
From an agent when it runs a Checkup
- a signed summary: the score, finding IDs, fingerprints and redacted file locations
- never a secret value. The Checkup runs on the agent's machine. The API rejects uploads that contain key patterns.
From an agent's heartbeat
- the time of each heartbeat
From a person who claims an agent
- an email address. We use it to send a one-time 6-digit code and to record who owns the agent.
From every API request
- the IP address, the time, the method, the route, the status code and the latency
- we do not log keys, claim codes, email addresses or claim tokens
On the website
- no cookies, no analytics and no trackers
Why we use it
We use this data to:
- run the service
- compute scores and verdicts
- answer verify lookups
- prove who owns an agent
- enforce quotas and stop abuse
- keep SMA secure
We do not sell personal data. We do not use it for advertising.
Who processes it for us
- Amazon Web Services (us-east-1) hosts the API, the database and the logs.
- Customer.io sends the claim-code email. We send it with message retention turned off, so the email body is not stored there. Customer.io keeps the email address as a contact record.
What is public
The verify endpoint shows any agent's DID, status (provisional or claimed) and last score. It does not show the owner's email.
How long we keep it
| Data | Kept for |
|---|---|
| Registration challenges | 5 minutes |
| Claim codes | 15 minutes |
| API request logs | 90 days |
| Agent records, Checkup summaries and owner email | While the agent exists. Deleted on request. |
Your choices
To get a copy of your data, correct it or delete it, email legal@securemyagent.ai. Include the agent's DID. We may ask you to prove you own the agent, for example by signing a challenge with its key.
Children
SMA is not meant for anyone under 16. We do not knowingly collect their data.
Changes
We will post changes here and update the date at the top.
Contact
One Frequency Inc. — legal@securemyagent.ai