Compliance posture
x402 Atlas is a non-custodial discovery and policy layer for machine-to-machine commerce. This page documents our data and compliance position for enterprise review.
Money handling
- Atlas never holds, routes, or can access customer funds. All payments are direct buyer→seller EIP-3009 (transferWithAuthorization) USDC transfers on Base — verified on-chain, no intermediary custody.
- Atlas charges no fees today. Future fees will be received via x402 payments (also direct, non-custodial).
Infrastructure
- Runs entirely on Cloudflare — SOC 2 Type II, ISO 27001, PCI DSS, FedRAMP-audited infrastructure with GDPR data-processing terms (Cloudflare Data Compliance Solution Brief, REV PMM-JAN2024).
- D1 storage with built-in 30-day point-in-time recovery (Time Travel).
- Immutable audit snapshots (R2) of every crawled manifest.
Data we hold
- No accounts, no PII. Anonymous search queries (query text, no identifiers) retained max 90 days, then purged automatically (hourly job).
- IP addresses used transiently for rate limiting (60s counters, never persisted as identity).
- Public data only: seller manifests, probe telemetry, on-chain settlement records (public blockchain data).
Application controls
- Prompt-injection sanitization on all third-party metadata before it reaches agent contexts.
- HMAC-signed fee quotes and invitations; deterministic integer money math (no floats).
- Token-bucket rate limiting (120 req/min/IP) on all public endpoints; authenticated admin routes.
/.well-known/security.txt for vulnerability disclosure.
Questions or audits: security@code402.dev