Trust center
Trust you can check, not only read.
How Agined handles your data, what we commit to on availability and incidents, and every legal document with its date. Each statement links to the document that binds it.
Operated by Avonao, Inc., DelawareLegal documents last updated November 7, 2026
Data residency7 Cloudflare regionsChosen per workspace on paid plans; Free is US West. The 3 European regions store data under Cloudflare's EU jurisdiction. Scale and Enterprise use the workspace's own Amazon Aurora database in an AWS region.Data regions →Breach noticeWithin 72 hoursThe account owner is told by email without undue delay, and within 72 hours, under the DPA.DPA §8 →Vulnerability reports3 business daysAcknowledgement target, with safe harbor for good-faith research and anonymous reporting. No bug bounty.Disclosure policy →Enterprise SLA99.9% monthlyUptime commitment with service credits, for Enterprise plans with a signed order form.Read the SLA →Sub-processorsListed, with noticeEvery vendor that processes data for Agined, what it processes and where, with notice before the list changes.Sub-processors →Security postureVerifiableHash-chained records and signed checkpoints, described on the security page.Security →
01
Availability.
What is checked and published live, and what we commit to in writing.
Live status
The status page publishes a check of each component of the service every minute, and keeps the history. The SLA measures downtime from those same checks.
Open the status pageEnterprise SLA
A monthly uptime commitment of at least 99.9%, with service credits on the monthly fee.
| Monthly uptime | Service credit |
|---|---|
| Below 99.9%, at least 99.0% | 10% of the monthly fee |
| Below 99.0%, at least 95.0% | 25% of the monthly fee |
| Below 95.0% | 50% of the monthly fee |
02
Incidents and disclosure.
How we tell you when something goes wrong, and how we handle what you tell us.
72h
Personal data breach
We notify the account owner by email without undue delay and in any case within 72 hours of becoming aware of a personal data breach.
/status
Incident communication
Incidents are published on the status page while they happen and kept in its history.
Reporting a vulnerability
Good-faith research is covered by a safe harbor, and a report can be anonymous.
| Step | Target |
|---|---|
| Acknowledge your report | Within 3 business days |
| Initial assessment and severity | Within 10 business days |
The full targets for fixes by severity are in the disclosure policy.
03
Compliance posture.
What is in place today, what we provide on request, and what we do not offer. Nothing here claims a certification we do not hold.
| Item | State | Detail |
|---|---|---|
| Data Processing Addendum | In place | Part of the Terms; applies on acceptance, no signature needed. |
| Standard Contractual Clauses | In place | Transfers outside the EEA and the UK are covered in the DPA. |
| Company details and representatives | In place | The contracting company, its addresses and its EU contacts. |
| Sub-processor list | In place | Purpose, location, personal data involved and safeguards for each vendor. |
| Privacy rights and opt-out | In place | Access, erasure, objection and the other rights, exercised from one page. |
| Security pack: whitepaper and questionnaire | In place | How Agined is built and run, and a vendor security questionnaire already answered. Send us your own form if it is not covered. |
| Customer audit | On request | Under the terms of DPA section 9. |
| Bug bounty | Not offered | We do not pay monetary rewards; we credit reporters by name or handle if they wish. |
04
Legal documents.
Every document, with the date it was last updated.
| Document | Covers | Updated |
|---|---|---|
| Terms of Service | The agreement between you and Avonao, Inc. for the Agined Attestor website, API, MCP server and dashboard, covering accounts, fees, refunds, acceptable use, data, liability and governing law. | |
| Privacy Policy | What personal data Agined Attestor collects, why, who receives it, how long we keep it and how to exercise your rights. | |
| Data Processing Addendum | The controller-to-processor terms under Article 28 GDPR that apply when Avonao, Inc. processes personal data on your behalf in Agined Attestor, with the EU Standard Contractual Clauses, the UK Addendum and the Swiss adaptations, sub-processors, security measures, breach notice, audits, deletion and the description of the processing. | |
| Sub-processors | The service providers that process personal data for the Agined Attestor service, what each does and where, and how we give notice of changes. | |
| Cookie Policy | The cookies and browser storage entries our sites use, what each is for, how long it lasts and how to change your choice. | |
| Acceptable Use Policy | What you may not do with Agined Attestor, how we enforce this policy, and how to report abuse or a vulnerability. | |
| Enterprise Service Level Agreement | The uptime commitment, service credits, incident response targets and chronic-failure rights that apply to Agined customers on an Enterprise plan with a signed order form. | |
| Responsible disclosure | How to report a security vulnerability in Agined Attestor, what is in scope, our safe-harbor commitment and what you can expect from us in response. | |
| Digital Services Act | Our points of contact for EU authorities and for users under the EU Digital Services Act, our legal representative in the EU, how to send a notice about illegal content, and how we decide on it. | |
| EU Data Act | How to switch from Agined Attestor to another provider or to your own systems, what you can take with you and in which formats, where each part of the Service runs, and how we guard your data against unlawful access by governments outside the EU. | |
| EU AI Act | How the EU AI Act applies to Agined, which part of the Service is an AI system, how Number One meets the transparency rules, and the Article 25(4) agreement for customers who build Agined into a high-risk AI system. | |
| Right of withdrawal | For consumers in the EU, the EEA and the UK, your right to withdraw from a paid plan, extra seats or a top-up pack within 14 days, how to do it, what you get back, and the model withdrawal form. | |
| Receipt Practice Statement | What an Agined receipt attests, how it is built, signed, timed and stored, which tools observe and which record reported facts, what a receipt does not prove, and what you still trust us for. | |
| Verifier Terms | The terms for anyone who checks or relies on an Agined receipt without being our customer, what a valid receipt lets you rely on, what it does not, and the limits of our responsibility to you. | |
| Key management | Which keys sign Agined receipts, where they are held, who can use them, how their public halves are published and pinned, how rotation works, and what happens if a key is compromised. | |
| Verifying receipts | How anyone can check an Agined receipt without us, offline if they want, with our libraries, the /verify page or a few lines of their own code, and what each result means. | |
| Format versions and long-term verification | How the receipt format and the API are versioned, which changes can happen within a version and which need a new one, and why a receipt issued today stays verifiable for good. | |
| Cryptographic agility and post-quantum status | Which signature algorithm protects Agined receipts today, what a large quantum computer would change, how receipts are built so the algorithm can change without breaking old ones, and where our move to post-quantum signatures stands. | |
| If Agined stops operating | What keeps working without us, what stops, what we commit to do if we ever wind the Service down, and what you can do today so your receipts stay usable as evidence whatever happens to Agined. | |
| Imprint | Who publishes Agined, where the company is registered, who represents it and how to contact it, including our representative in the EU. |
Security pack: whitepaper and vendor questionnaire → All legal documents →
05
Request documentation.
Procurement and security reviews: tell us what you need and we answer.
Security
Security pack and questionnaire
Read the whitepaper and the answered questionnaire, or send us your own and the security team answers it.
Open the security pack →EnterpriseTalk to us about an order form
Enterprise terms, the SLA and a signed order form.
Contact us →VulnerabilityReport a vulnerability
Anonymously if you prefer; acknowledged within 3 business days.
Report →PrivacyPrivacy request
A data protection question or a request about your data.
Email privacy →