Answers for your security review.
Your data stays in the EU. Test access you give us is deleted after the drive.
- What we keepYour account's email, your orders and what you send us. API keys are stored hashed. Each item, and how long we keep it, is in the privacy notice.
- Where it runsOur servers and database are in Germany, in the EU. Backups are encrypted. The privacy notice lists who else processes data for us, and where.
- Test access you give usUsed for your drive only, and deleted when the drive is done.
- How our agent testsIn its own test account, made at sign-up, so it never sees your users or their data. Its web requests carry a Web Bot Auth signature your bot manager can verify.
Last updated 12 October 2026
Report a security issue.
Found one in AgentDrives? Write to hello@agentdrives.com, in English or Dutch.
- In scopeOur own systems: agentdrives.com, its API and MCP server, the dashboard and agent.agentdrives.com. A problem in a product we drove: report it to its owner.
- What to sendWhat you found, where, and the steps to see it again. Test only on your own account, leave other people's data alone, and don't slow the service down.
- When we answerWithin one working day: that we have it. Within three: what we think and what happens next. When it is fixed, we agree with you when you may publish.
We have no paid bug bounty, and don't pay for reports of missing headers, mail settings or other results of automated scanners.
Stop our agent with two lines.
Add them to your robots.txt and our agent stops driving your product. Or write to us, and we stop.
- User-agent: AgentDrivesAgent
- Disallow: /
During a drive our agent follows robots.txt for every page it reads. Inside the test account it creates (the sign-up form, the verification link, logging in, the key page, calls with its own key, cancel and delete), a rule for all user agents is a rule for crawlers, so it goes on. A rule that names AgentDrivesAgent, or AI agents that act for a user, always stops it.