Does this make us PCI DSS compliant?

No. AgentProof tests and fixes your app. It does not certify you for PCI DSS or any other standard. Its reports show what was tested and how each problem was fixed.

Will fixes go live without review?

Only if you choose that. With pull requests, your team reviews every change before it merges.

How long are reports kept?

For as long as your account exists. Deleting the workspace deletes them. Removing a teammate does not.

AGENTPROOF TESTS
AND FIXES
FINTECH APPS.

Fintech apps move money and show balances. AgentProof checks that no user can send, see or change money that is not theirs, and fixes your code when one can.

The Attack Agent tries to move money in ways your app should refuse.

WRONG ACCOUNT: Can a user send a transfer from an account that belongs to someone else?
AMOUNTS: Can a user change the amount after it was approved, or send a negative amount?
REPEATS: Does sending the same payment request twice pay it out twice?
APPROVALS: Can a payment that needs a second approval go through with only one?
STATEMENTS: Can a user download another customer's statement by changing a number in the link?
LIMITS: Can a user get around a daily transfer limit by splitting one payment into many small ones?

For each problem, the report shows the request that was sent and what your app did with it.

An example: sending one payment request twice paid it out twice.

EXAMPLE FINDINGA repeated transfer request is paid twice

REQUEST

POST /api/transfers, sent twice
Same request ID, same moment

RESPONSE

201 Created, 201 Created
Two transfers of $500 made

FIX

- await db.transfers.insert(input);
+ // request_id has a unique index, so a repeat fails
+ await db.transfers.insert({ ...input, requestId });

RETEST

POST /api/transfers, sent twice
201 Created, 409 Conflict. Fixed.

Each payment request now carries an ID that the database accepts only once, so a repeat is refused.

Your payment code is tested every month, week or day, not once a year.

A YEARLY TEST

Tests the app as it was that week
Misses changes made after it ends

AGENTPROOF

Tests again on your schedule, so a change to transfer code is checked within a month, a week or a day.

Common questions from fintech teams, answered.

DOES THIS MAKE US PCI DSS COMPLIANT?: No. AgentProof tests and fixes your app. It does not certify you for PCI DSS or any other standard. Its reports show what was tested and how each problem was fixed.
WILL FIXES GO LIVE WITHOUT REVIEW?: Only if you choose that. With pull requests, your team reviews every change before it merges.
HOW LONG ARE REPORTS KEPT?: For as long as your account exists. Deleting the workspace deletes them. Removing a teammate does not.

Every plan includes both agents for one fintech app.

Monthly checks cost $199 a month and weekly checks cost $399. Daily checks cost $999 a month.

See plans See how fixes work

AgentProof also tests these kinds of apps.

AgentProof is in development. The example finding on this page is an illustration, not a result from a customer's app.