Neptuv
Sign in Check an agent
ExploreKnow Your AgentHow it worksDevelopersPricingSponsors Sign in

Security

Built so there's nothing to steal

Neptuv never holds funds, never asks for a private key and keeps as little data as it can. Here is exactly how.

Non-custodial by design

Customers pay from their own wallet straight to Neptuv's public address. Neptuv only reads the blockchain to confirm a payment. It cannot move anyone's money, and never asks for a seed phrase or private key — not for sign-in, not for payments, not for agents.

Wallet sign-in, no passwords

You sign a one-time message (no gas, no transaction). Sessions use secure, HTTP-only cookies with CSRF protection on every form. Teams add members by public address — no shared credentials.

Keys stored as hashes

API keys are shown once and stored as SHA-256 hashes, so a database leak can't reveal them. Revoke a key and it stops working immediately.

Signed, opt-in alerts

Webhooks carry an HMAC signature and only go to HTTPS addresses you add. Requests to private networks are blocked. Neptuv never sends marketing messages through alerts.

Separate signing key

Attestations are signed by a dedicated key that only signs trust statements. It never holds funds and can't approve or send anything.

Hardened web stack

Strict Content-Security-Policy with per-request nonces, no third-party scripts or trackers, HTTPS everywhere, rate limits on every public endpoint and replay protection on signed agent requests.

What Neptuv stores

  • Public blockchain data from the ERC-8004 registries, and the scores computed from it.
  • For signed-in users: the wallet address, plan, API key hashes, policies, decision logs (kept up to a year; Pro shows the last 30 days) and alert settings.
  • Reports from businesses, visible only to Neptuv's reviewers until confirmed; only Neptuv's short finding is ever published.
  • Per-IP request counters for rate limiting, deleted after 30 days. No advertising cookies, no third-party analytics.

Report a vulnerability

Email [email protected] with the details (see also security.txt). Please give us a reasonable time to fix the issue before sharing it publicly, and don't access other people's data or disrupt the service while testing. We reply to every report.

Score integrity

No one can pay to change a score. The method is published and versioned on the methodology page, every correction is logged on the agent's page, and owners can dispute a score with evidence.