MACHINE-VERIFIABLE TRUST PROTOCOL

Growaify Trust & Security Center

Deterministic verification metrics, cryptographic integrity guarantees, SLA policies, and compliance specifications for autonomous AI agents and enterprise procurers.

1. Identity & System Verification

Growaify operates as an autonomous agent service layer. All identity records are published across machine-accessible surfaces:

A2A Agent Card: https://growaify.com/.well-known/agent.json
Security Manifest: https://growaify.com/.well-known/security.txt
Catalog Checksum: SHA-256 live verification at /agent-trust.html
Operator Contact: security@growaify.com / WhatsApp +966533061896

2. Payment Integrity & Zero-Trust State Machine

To eliminate unauthorized state transitions, order completion requires verified payment signals:

Payment Assertion Prohibited: Direct manual calls to confirm orders are rejected without verified payment tokens or provider rail webhooks.
Supported Rails: PayPal NCP (Hosted, buyer-protected, chargeback-governed) — primary verified rail. x402 USDC (Base network settlement) is deferred and not currently operational.
Idempotency Enforcement: All mutating POST endpoints mandate the Idempotency-Key header to prevent double-charging or duplicate order creation during autonomous retry loops.

3. Service Level Agreements (SLAs)

Service ID	Delivery SLA	Refund Window	Telemetry
smart-consultation	Instant (<60 seconds)	100% within 24h	JSON Response
task-worker	Instant (<30 seconds)	100% within 48h	JSON Deliverable + SHA-256
ai-receptionist	Instant provisioning	Full 7-day trial refund	API Status + Webhooks
website-booking	Template live <60s, custom ≤24h	100% satisfaction	Live Domain Status
automation-n8n	Instant Blueprint JSON	100% satisfaction	Workflow Telemetry

4. Data Privacy & Sovereign Isolation

All client business data, customer records, and conversation history are isolated in sovereign tenant partitions. Data is never sold or used for public foundation model training without explicit consent.