Privacy Policy

1. About this policy

Authenord provides an AI-agent identity registry, signed identity credentials and verification tools. This policy describes information handled through authenord.com and the Authenord services linked from it. You can reach the Authenord team at [email protected].

Services you connect to with an agent, and websites linked from our resources, have their own privacy practices. Their handling of information is outside this policy.

2. Information we handle

• Account information: the email address and authentication information used to create and access an account. Authentication is handled by Supabase.
• Registry and workspace records: declared organisation domains, membership, agent names and descriptions, registered public keys, credentials, issuance and expiry dates, revocations and audit events.
• Verification information: credentials submitted for online verification, identifiers used for status lookups and the technical information needed to process those requests.
• Enquiries: the name, email address, company, topic and message you submit through the contact form or email.
• Connection and operational information: hosting and security providers may process IP addresses, browser or device information, request times, error details and access logs to deliver, secure and maintain the service.

Provide only information appropriate for an agent identity record. Do not include passwords, private keys, confidential customer information or sensitive personal information in public fields or contact messages.

3. How we use information

We use information to provide accounts and workspaces; register agents and public keys; issue, verify and revoke credentials; respond to enquiries; maintain service performance; prevent misuse; investigate security incidents; and meet applicable legal obligations.

Where applicable law requires a legal basis, these purposes may rely on providing the service you request, legitimate interests in operating and protecting that service, compliance with law, or consent where required. If you choose not to provide required registration information, we may be unable to create your account or provide the requested service.

We do not sell account or registry information for advertising. Authenord credential checks concern the integrity and status of agent identity records; they do not make employment, credit or similar eligibility decisions about people.

4. Public records and shared credentials

Issuer public keys are published. Public agent and credential status endpoints disclose identity and status records to people or systems that know the relevant identifiers. A credential you share exposes the claims within its signed payload, including its registered key and recorded organisation information.

Recipients may keep copies of credentials you send them. Revocation changes the status of a credential; it does not remove copies from other systems. Consider the contents before registering or sharing a record, and do not treat an identifier as a password or access control.

5. Private keys and local verification

When you generate an agent key through the website, generation happens in your browser. The website registers the public key; it does not upload the agent private key. Downloaded private-key files remain your responsibility to protect.

Online verification sends the submitted credential to the Authenord verification API. Browser-local and downloaded offline verification tools operate on the files you supply locally. A receiving service using our SDK may forward your credential to Authenord for a current status check.

6. Service providers and other disclosures

Providers help us deliver specific parts of the service:

• Cloudflare: website hosting, delivery, security and website performance or traffic measurement.
• Supabase: authentication, database storage and backend processing.
• FormSubmit and email providers: processing contact-form messages and delivering enquiries to our inbox.
• Google Fonts: delivery of the website’s typefaces.
• YouTube and DigiCert: delivery of embedded industry videos.

These providers may process information needed to perform their functions under their own applicable policies. We may also disclose information when required by law, to investigate misuse or protect rights and security, or as part of a business transfer subject to appropriate legal requirements.

A company logo or linked publication does not mean that the company receives your account information. Registry claims and credentials are shared as described above.

7. Browser storage, analytics and embedded content

The website uses this browser tab’s session storage for sign-in tokens. Signing out clears the site’s saved session. Browser settings and session-restoration features may affect how long tab data remains available.

Cloudflare’s website analytics beacon may be supplied by our hosting configuration to measure traffic and performance. Cloudflare describes its Web Analytics service as privacy-focused and not collecting or using visitors’ personal data. Hosting and security processing are separate from those analytics metrics. Read Cloudflare’s description for details.

Fonts and embedded videos can cause your browser to connect to external providers, which may process connection or playback information and use their own storage or cookies. YouTube embeds use its privacy-enhanced domain, which does not mean that playing a video involves no data processing. You can manage storage and cookies in your browser and choose not to play external media. Some service features may not work when required browser storage is blocked.

8. Retention and international processing

Retention depends on the purpose of the record: operating your account and registry, maintaining credential history and revocation integrity, responding to enquiries, security needs and applicable legal obligations. We do not promise a single retention period for all records.

Some audit, credential-status and revocation records may need to remain after an account closes to preserve the reliability of previously issued evidence. Copies shared with recipients and provider backups may follow separate retention processes. Contact us to discuss a specific record or deletion request.

Our providers may process information in countries other than your own. Applicable data-protection requirements and safeguards depend on the service, location and circumstances. Contact us for information about a particular processing arrangement.

9. Your choices and requests

Depending on the law that applies to you, you may have rights to access, correct, delete or obtain a copy of information, restrict or object to certain processing, or withdraw consent where processing relies on it. Withdrawal does not undo lawful processing that occurred beforehand. You may also have a right to complain to your local data-protection authority.

Send requests to [email protected]. We may need to verify your identity and authority before responding. Some requests may be limited by legal obligations, security requirements, other people’s rights or the need to preserve credential history. Revocation and deletion are different actions; contact us if you need help understanding their effects.

10. Security, children and policy updates

We use measures such as HTTPS, workspace access controls and signed credential records to protect service operations. No online service can guarantee absolute security. Keep account credentials and private agent keys secure, and report suspected compromise promptly.

The service is intended for business and developer use and is not directed at children. Contact us if you believe a child’s information has been submitted inappropriately.

We may update this policy as the service or applicable requirements change. The date above identifies the current policy. Where required, material changes will be communicated through an appropriate service channel.