Trust
Security and status
What A2A Check does with your files, where they are processed and how to reach us.
How A2A Check handles your data
- Read only
- Your agent configuration is reviewed, never executed or changed. You or your agent make the changes.
- Approval
- Your agent only submits files that you have seen and approved beforehand.
- Credentials
- Detected credentials such as keys and tokens are removed on intake and not stored.
- Location
- Processing on Google Cloud in the EU. No data is passed to external AI model APIs.
- Retention
- In the free account reports are stored for 30 days, then deleted. You can delete your account at any time.Plans and limits
- Sign-in
- You sign in with your company email and a single-use 6-digit code. A sign-in to the portal ends after seven days; in the portal you can sign out everywhere.
- Rules
- Rule catalog and patterns are public, versioned and openly licensed (CC BY 4.0). Every finding names its rule.Rule catalog
- Agreements
- The privacy policy, the terms of use and a template for data processing are public on this website.Privacy policy (German)Terms of useDPA template
Status
- The service is checked automatically every night: the sign-in, the forms and one complete test check.
- There is no public status page yet.
Report an outage or a vulnerability
Write to the following address or use the contact form. Please do not include any credentials.
What the review does not do
- It does not observe what the agent does at runtime.
- A report without findings does not mean the agent is safe.
- It does not replace a penetration test.
- Areas it cannot review are marked as “not reviewable” in the report.