Where your data is

  • Forms, answers, uploaded files and backups are on our servers in Germany (EU), rented from eHost. Nothing is stored outside the EU.
  • The companies that handle data for us are all in the EU, and listed under Sub-processors. Answers go elsewhere only where you send them (a Google Sheet, a webhook, a UiPath queue).

Forms

  • Public forms live on their own address (f.agent002.net), apart from the app and this site.
  • They set no cookies, load nothing from other companies and run under a strict Content Security Policy, so only our own code runs on them.
  • No IP addresses or device details are stored with answers. Instead of a CAPTCHA, each answer solves a small proof-of-work puzzle in the browser; rate limits stop floods.
  • Forms that ask for passwords, card numbers or similar details are blocked before they go live, and anyone can report a form to abuse@agent002.eu.

Encryption

  • All traffic uses HTTPS, with HSTS.
  • Uploaded files are encrypted, each with its own key.
  • Secrets for connections (Google, webhook signing, UiPath) are encrypted, with the keys kept apart from the database.
  • Passwords are stored only as salted hashes.

Uploaded files

  • Each file is checked by its content, not its name: programs, scripts, web pages and SVG files are refused.
  • Files are scanned for viruses on our own servers while they arrive. They are never sent to another company to be scanned.
  • Only the form’s team can download them, and they are deleted with their response.

Accounts and teams

  • Passwords have at least 10 characters. After 8 wrong tries, an account locks for 10 minutes.
  • The app uses one cookie to keep you logged in, which scripts can’t read. With two-step sign-in, two more: one for the few minutes between your password and your code, and one for a browser you chose to trust for 30 days.
  • Each organization’s data is kept apart in one place in the code, covered by automated tests, so one account never sees another’s forms or answers.
  • In a team, only the owner manages billing and who is in it.
  • Two-step sign-in: after the password, a code from an authenticator app on your phone that changes every 30 seconds, with ten single-use recovery codes for a lost phone. Optional for customers (under Account), required for our staff. Turning it on or off signs you out everywhere else and is confirmed by email.

Our own access

  • Staff tools run as a separate app on their own address, open only to named staff accounts that use two-step sign-in. They never show answers.
  • Only named staff, with personal SSH keys, can reach the servers. Releases go out through an automated pipeline, and every change passes automated tests first.

Backups and deletion

  • The database, encryption keys and uploaded files are backed up every night, encrypted, and kept for 14 days.
  • Answers are deleted automatically when a form’s retention period ends. Deleted answers leave the backups within 14 days.

Connections

  • Webhooks are signed, so your server can check they came from us. They can’t be pointed at private networks.
  • Failed deliveries are retried, and you’re told if a destination keeps failing.

If something goes wrong

If a security incident affects personal data you entrust to us, we tell you without undue delay, and within 48 hours of finding out, as our data processing terms promise. Changes to our sub-processors are announced at least 30 days ahead, in the changelog and on the Sub-processors page.

Report a vulnerability

Write to security@agent002.eu (also in our security.txt). We reply within two working days.

If you research in good faith, don’t access or change other people’s data, don’t disrupt the service, and give us reasonable time to fix the issue before telling others, we won’t take action against you. We don’t run a paid bug bounty.