// PROTOCOL SECURITY

How We Keep
Your Money Safe

Every claim on this page is verifiable on-chain or in our public source code. We do not ask you to trust us — we ask you to verify.

Connecting is completely safe

When you click "Connect Wallet", your wallet app (MetaMask, Coinbase Wallet, etc.) creates a read-only link between your browser and our site. This is equivalent to showing someone your bank account number — they can see it exists, but cannot touch it.

WHEN YOU CONNECT, WE CAN
See your wallet address
This is already public on every blockchain. Like seeing someone's username.
Show you your purchase history
We read on-chain records tied to your address.
Personalise your dashboard
Your address is your identity — no username or password needed.
WHEN YOU CONNECT, WE CANNOT
Move your funds
Connecting does not give us any authority over your tokens, ETH, or NFTs.
Access your private key
Your private key never leaves your wallet app. Ever.
Initiate transactions on your behalf
Every transaction requires your explicit approval inside your wallet app.

Every transaction happens on-chain

When you purchase an agent, your payment goes directly into a smart contract — not a bank account or a company wallet. The contract automatically releases your access token and sends the seller their funds. We cannot intercept or redirect this flow.

THE CONTRACT CAN
Accept your payment
ETH, USDC, or USDT — exactly the amount shown.
Charge a 3% platform fee
Deducted automatically. Transparent in the code.
Mint your access token
Permanent on-chain proof of purchase — yours forever.
Pay the seller instantly
97% of your payment goes to the seller's wallet, on-chain.
THE CONTRACT CANNOT
Access your other tokens
It can only receive what you explicitly send to it.
Be paused or upgraded
The contract is immutable. No backdoors. No admin override.
Move funds to a hidden wallet
Every fund flow is publicly visible on-chain, forever.
Charge you more than approved
Your wallet shows the exact amount before you sign.

Every file is encrypted before upload

Sellers upload their agent files to our backend. Before the file reaches IPFS (the decentralised storage network), we encrypt it using AES-256-GCM — the same encryption standard used by banks and governments. The file is only decrypted when a verified on-chain purchase exists for the buyer's wallet address.

01
Seller uploads file
Sent encrypted over HTTPS to our backend.
02
AES-256-GCM encryption
File encrypted with a unique key before leaving our server.
03
Stored on IPFS
Encrypted file stored on Pinata IPFS. The CID is recorded on-chain.
04
Buyer completes purchase
Smart contract records access. Token minted to buyer's wallet.
05
Backend verifies purchase
We check on-chain that buyer's address holds the access token.
06
File decrypted and served
Only then do we decrypt and deliver the file. No token = no access.

Every listing is reviewed by a human

No listing goes live automatically. Every submission is manually reviewed by our team before approval. We check for: functionality claims, malware, misleading descriptions, and seller identity anchored to a real wallet.

Seller pays $1 listing fee
Priced via Chainlink oracle. Filters bots and uncommitted sellers.
Listing submitted for review
Our team reviews title, description, deployment instructions, and file.
Description and instructions reviewed
We verify the listing description, deployment instructions, and delivery content match before approval.
Approved or rejected within 24–48h
Seller notified by email. Wallet permanently recorded on-chain regardless.

What we guarantee to sellers

Sellers are the backbone of AgentYOUr. Here is exactly what the protocol guarantees you — not as a promise, but as verifiable on-chain behaviour.

YOU ARE GUARANTEED
97% of every sale, instantly
The smart contract sends 97% of the buyer's payment directly to your wallet address on-chain — no delays, no manual payouts, no minimum thresholds.
Permanent on-chain identity
Your wallet address is recorded on every listing and every sale. Your reputation is yours — no platform can delete or reassign it.
AES-256 file protection
Your uploaded file is encrypted before it reaches IPFS. Only verified buyers can access it. Your IP is protected by cryptography, not policy.
Human review of every listing
We manually approve listings. This means buyers trust the marketplace — and that trust converts into sales for you.
WE WILL NEVER
Hold your funds
Payment flows directly from buyer to your wallet via the contract. We are never in the middle.
Delist you without reason
Listings are only rejected or removed for violating our published seller terms. No arbitrary moderation.
Share your file without purchase
Your encrypted file on IPFS cannot be decrypted without a valid on-chain access token. There is no backdoor.
Charge hidden fees
The 3% platform fee and $1 listing fee are the only fees. Both are enforced transparently in the public contract code.
Ready to list your agent? The $1 listing fee is the only commitment required.
List Your Agent →

Powered by trusted protocols

Base
Layer 2 blockchain — fast, cheap Ethereum settlement
Ethereum
Layer 1 blockchain — maximum security and decentralisation
Chainlink
Price oracle — converts $1 listing fee to exact ETH amount
Pinata IPFS
Decentralised file storage — files are not on our servers
RainbowKit
Wallet connection — open source, audited, used by millions
Resend
Transactional email — purchase confirmations and access delivery
// FOUND A VULNERABILITY?

We take security seriously. If you discover a bug, exploit, or vulnerability in our smart contracts, backend, or frontend — please contact us immediately before disclosure.

security@agentyour.ai →