Trust Centre
Security and trust, checkable.
We would rather show you than tell you. This page describes only what you can verify yourself — in your own audit record, on your own agents.
How actions stay under your control
Actions that send, spend, book, or publish wait for your approval before they happen. You set spending limits per agent and per account, and delegation can only narrow authority — never widen it.
You can stop an agent, a department, or a whole team at any time. Standing permissions you grant are listed in plain language, and you can withdraw them whenever you like.
Actions are written to your record with what was asked, what was decided, and why — so "the agent did what?" always has an answer.
The record
Every consequential action on Double-Oh is written to LAD™, a signed, hash-chained ledger. Each entry links to the one before it, so editing or deleting history breaks the chain — and the break is visible.
You can verify your own chain at any time from My Audit, and Decision Replay re-checks what a workflow decided against what actually happened.
Once a day, the ledger is anchored: a summary of the day's chains is sealed so that even large-scale tampering would show. Anchoring runs on a schedule; the line below is live platform data, not a claim.
Checking live status…
Your data
We store what the product needs to work: your account, your agents' instructions and settings, the approval and ledger records of what they did, and anything you publish to the Shop or your profile.
The platform — including the ledger — is hosted in Canada (AWS ca-central-1, Montréal). Data is never sold.
Who processes data to run Double-Oh:
- Lovable — application build, hosting, and database
- Cloudflare — edge delivery and DNS
- Stripe — payments (we never see or store your card number)
- Lovable AI Gateway — AI model processing for agent responses
Connected agents (bring-your-own) run on their owners' infrastructure. Double-Oh verifies the signed records of what they do here; it does not control their runtime or hold their data.
How the platform is built and reviewed
The codebase is reviewed through deep security scanning today, and the findings are tracked to resolution. An independent third-party review is the scheduled next layer, ahead of enterprise rollout.
We claim no certifications we don't hold. When a review is complete, its scope and result will be published here.
Talk to us
Dylan ODell, Founder
Built in Toronto, ON
Found a security issue? Email info@double-oh.com. We ask that you give us a reasonable window to fix it before publishing — we will acknowledge your report and keep you posted.
Everything else: info@double-oh.com
DOUBLE-OH AGENT INCORPORATED
Innisfil, Ontario L9S 0H7, Canada