Security and data
We test what your agent decides, not your systems. Here is what we see, what we never touch, and where the data goes.
Nothing runs on your side
Your agent is plugged into inert copies of its tools: same names, same buttons, no effect. A refund, an email or a deletion it triggers is recorded, never executed, on your systems or your clients'.
No access, no keys
We ask for no login, no API key, no network access. A workflow export (n8n, Make, Flowise, Dify) is enough, and n8n does not export your keys. If you prefer to plug the agent itself in, the address we give you is the only door: it leads only to the simulated tools.
Fictitious data
The customers, orders and files in the scenarios are made up. The test needs no real personal data; if you send any by mistake, we delete it at the end of the test.
Where the data goes
The site and reports are hosted in France (OVH). Calls to AI models go through OpenRouter (United States), which receives the fictitious scenarios, your agent's description, your answers and, if you import it, its configuration (instructions and tools). Would you rather keep your instructions in-house? Give us the address of your own model: the test runs on it.
For how long
Requests and reports are kept for 3 years for the re-test and follow-up, then deleted, or earlier on request. Technical logs: 90 days at most.
Confidential, both ways
Your report is never published and your name appears nowhere. Only anonymous, aggregated statistics may be used, never for a figure covering fewer than five agents. The link to your journey is secret and not indexed.
A question from your security team?
The details are in our privacy policy; write to us for anything else. Privacy policy · Our method · cdelage.dev@gmail.com