Security
What is deployed now, and what is not.
This page separates deployed controls from open work. We list only what a person can check.
Agent Journey Lab does not claim SOC 2, ISO 27001, GDPR compliance, a penetration test, or an uptime SLA.
Send a security reportRead the pilot scope
Our test sessions declare AgentJourneyLab/0.1. Site owners can stop a public test: read the research boundary or write to research@agentjourneylab.com.
Deployed
Deployed controls
Each row below is a control in the current release build. A person can check each one against the running service.
- Deployed
Customer-site execution is disabled in this build
An authorized job is refused before any browser action and before any provider action. We do not present this as a deployed customer-testing capability.
- Deployed
Provider agents are off in production
The build makes no provider call. No provider spend is possible from this build.
- Deployed
A start check before any work
The service runs a deterministic fixture calibration at start. A failed calibration makes the private readiness record unhealthy.
- Deployed
A source and action boundary in code
The runner binds each action to a checked page element and refuses an action outside the declared journey source.
- Deployed
Written authorization before form data
The runner enters no form data outside a scope that you approve in writing.
- Deployed
Evidence outside the web root
Run records are written outside the public site directory. No record is URL-addressable.
- Deployed
No public control surface
The public service answers the site pages and one health address. It accepts no job, no upload, and no command.
- Deployed
A declared test identity
Public test sessions declare AgentJourneyLab/0.1 in the user agent string.
- Deployed
A site with no third-party code
The pages load no script, no font, no image, and no file from another origin.
Open work
Open work
These items are in progress. They are not deployed controls today. We move an item to the deployed list when it is deployed and we can show it.
- Open
Browser and process isolation
A disposable non-root browser unit for each job is not separated yet.
- Open
Job-scoped egress control
Outbound network limits for each job are not separated yet.
- Open
Resource ceilings
Time, memory, and page limits for each job are not enforced by the platform yet.
- Open
Separate evidence storage
Customer storage with encryption at rest is not separated yet.
- Open
Provider credential separation
Provider credentials are not held in a separate boundary yet.
- Open
Supply-chain evidence
A published build and dependency record is not in place yet.
- Open
Operations, privacy, and legal work
Logging, retention, and legal review are in progress.
Not claimed
Not claimed
- Not claimed
Certification
We hold no SOC 2 report and no ISO 27001 certificate.
- Not claimed
Compliance
We make no GDPR compliance statement on this page.
- Not claimed
Testing
We have no penetration test report to show.
- Not claimed
Availability
We give no uptime figure and no service level agreement.
- Not claimed
Enterprise readiness and customer outcomes
The software is not enterprise-ready. We show no customer, no customer result, and no outcome metric.
A healthy fixture build does not prove isolation, provider safety, authorized customer execution, enterprise readiness, uptime, or customer value.
Report a problem
Report a problem
Email us with "security report" in the subject. We confirm that we received the report. We take no legal action against good-faith research. Please keep the detail private until the problem is fixed. We operate no bug bounty today.
Next step