Agents get capability, never your raw credentials
Card data is minimized, credential reveal is reauthenticated and audited, and every sensitive action leaves a record you can export.
What we store, and what we refuse to
No plaintext PANs, ever
Card numbers are never written to the application database, and CVV values are never persisted at all.
Reauthenticated reveal
Revealing credentials requires a fresh authentication, returns a short-lived token, and expires the session automatically.
Scoped, rotatable keys
Secrets are hashed at rest and displayed exactly once. Keys carry permissions, environments, and expiry dates.
Row-level security
Every table is scoped to the organization and role, enforced in the database rather than in application code.
Audit logging
Actor, action, resource, IP, and user agent for each sensitive operation — exportable for compliance review.
Separated environments
Test and production data never mix. Test-mode surfaces are labelled everywhere, all the time.
Signals we watch
- Unusually large transaction
- Unknown merchant
- New geographic location
- Multiple rapid attempts
- Repeated declines
- Amount just below an approval threshold
- Merchant category mismatch
- Newly created agent
- Recently rotated credential
- Purchase outside working hours
- Behaviour outside the agent's baseline
- Duplicate purchase
- Unverified delivery address
What happens next
- Allow
- Allow and monitor
- Request approval
- Decline
- Freeze card
- Pause agent
- Notify administrator
- Require identity verification
Prototype disclosure
AgentPay is currently a functional prototype. Cards, balances, authorizations, and merchant checkouts are simulated. AgentPay is not a card issuer and does not claim a sponsor bank, compliance program, or processor relationship. Real issuance will require an issuing provider, KYC and KYB onboarding, and network approval for exposing card credentials to autonomous agents.
Inspect the controls yourself
Create a test organization and walk through reveal flows, audit logs, and risk responses.