There is nothing to steal.

We authorize, never settle. Money always moves on a licensed rail — your PSP, or wallet-to-wallet. What we hold is decisions and their evidence.

What you give · what we store

card number (PAN)

never touches us — stays with your bank / PSP

wallet private keys

never touch us — the agent generates and holds its own key

KYC documents

stay with the licensed provider; we store only verified + DID

owner's identity

published as a single bit: verified. No names, no documents, ever

mandate limits

stored by us, visible only to the owner — never on public pages, never to agents

decisions & receipts

signed, timestamped, independently verifiable in your browser — that's the product

The five properties

Proof-of-possession everywhere. No bearer secrets: agents sign every request (RFC 9421); a stolen token is useless without the agent's private key.

Fail-closed. If our gate is unreachable, the money action is refused — never waved through on stale state.

Revocation in seconds, verifiable by anyone. The owner's stop button flips the public lookup immediately; serving a revoked agent is provably the server's choice.

Evidence without trust. Receipts verify in the browser against published keys — you don't have to trust us, and neither does an auditor.

Your perimeter, if you want it. The enforcement layer also ships as a self-hosted sidecar: your data never leaves your infrastructure.

Questions, disclosures, or a security review request: info@regentprotocol.org. Receipts are evidence for disputes; outcomes remain governed by the rules of the payment networks involved.