Privacy
What this site collects is bounded by what it is able to do.
This is a static content property. It resolves nothing on your behalf, authenticates nobody, and holds no account. Most of the statements below are true because of how it is built rather than because of a policy someone has to remember.
Two files decide all of it: the analytics module, which is the only code that can send anything anywhere, and the response headers, which bound where the browser is allowed to send it. This page describes what those files actually do — including the two places where something does leave.
Never collected
Five categories with no route into this property.
Source code
There is no code input, no upload, no repository connection and no paste target anywhere on this property. Nothing here can receive a file.
Prompts and conversation content
This site does not run, host, proxy or observe an agent. It never sits between your agent and a model, so there is no point at which a prompt or a completion could pass through it.
Secrets and credentials
No account exists on this property and nothing here authenticates you. There is no password field, no API key field and no token exchange. Sign-in happens on TrustOps, not here.
Personal identity evidence
Documents, officer identity and liveness evidence belong to the verification products and are handled on the surfaces that run them. None of that material has a route into this site.
Agent telemetry
No traffic, no traces, no logs from your agents, and no connection from an agent to this site. ECZ-ID stays outside the execution path, so there is nothing to instrument.
The one thing you can type
The ECZ-ID you enter on /verify never leaves your browser.
What happens when you press Look up
The identifier is normalised and checked against the ECZ-ID grammar in your own browser. If it is well formed you are handed a link to the live Resolver. This site does not fetch the record for you, so the lookup never becomes a request to this origin carrying the identifier.
What the analytics event carries
The shape of the input and nothing else: well-formed parent, well-formed child, or malformed. Not the value, not a hash of the value, not its length.
This matters more than it first appears. An ECZ-ID identifies an organisation, so a stream of looked-up ECZ-IDs would be a record of who is checking whom — which supplier a bank is assessing this week, which competitor an operator resolved twice in an hour. That is not ours to hold, and the reliable way not to hold it is to be structurally incapable of receiving it.
The same reasoning is why the lookup is not proxied through this origin: proxying would make this property a party to every check.
What can be sent
The complete event vocabulary, and what each event carries.
| Event | What it carries | What it never carries |
|---|---|---|
| agent_site_view | The page slug, plus any allowlisted campaign parameters and the referring host. | A full referrer URL, a visitor id, or anything you typed. |
| free_passport_requested | Which family the CTA was for (Agent or MCP) and the corridor label of the button that was clicked. | Who you are, which organisation you belong to, or what you go on to create. |
| agent_site_verify_lookup | The shape of the input: well-formed parent, well-formed child, or malformed. | The identifier, a hash of it, or its length. |
| resolver_opened | Whether the human page or the machine record was opened, as a two-value flag. | Which record was opened. |
| agent_site_framework_selected | The framework slug, from the fixed list this site publishes. | Anything about your stack beyond the link you followed. |
| Other site events | A fixed label from a closed set defined in code: a placement, an offer slug, or nothing at all. | Free text of any kind, because there is no free text to carry. |
What every event also carries
The path of the page you were on and a timestamp. Nothing else is added, and no identifier is attached to tie two events together.
When nothing is sent at all
The endpoint is configuration. If a deployment sets none, the analytics module returns without sending anything; in development the event is written to the browser console and goes no further. Where an endpoint is configured, it is on this origin — and, like any HTTP request to any host, the receiving server sees the network-level facts of the request itself.
No identifier, no third party
No cookie is set, no visitor id is generated, no third-party script is loaded.
No cookie
This site sets none. There is no consent banner because there is nothing to consent to, not because one was omitted.
No visitor id
No device or visitor identifier is generated, stored or attached to an event. Two page views by the same person are not joinable by anything this site sends.
And it is enforced, not merely intended
The Content-Security-Policy this origin sets includes connect-src 'self'. A third-party collector could not be reached from your browser even if one were added to this codebase by mistake.
The exception
One asset on this site is loaded from another origin.
The Live Proof badge image
The badge in the footer is drawn by the ECZ-ID badge service at api.ecocitizenz.com from the current state of our own public record. Your browser requests that image directly, which means that origin sees an ordinary image request from you — the same facts any host sees for any image: the request itself, your IP address, your user agent and the time.
It is a plain image element rather than a proxied or cached one, and that is deliberate: caching a state-bearing badge through this origin would let us serve a stale picture of current state under our own name. We would rather the badge be live and the request be visible than the reverse. It is the only remote origin the image policy permits, named explicitly rather than by wildcard.
Campaign parameters
Four query parameters are read, and the referring host — never the referring URL.
The allowlist, and the bound on it
Exactly four keys are read from the URL:
- utm_source
- utm_medium
- utm_campaign
- utm_content
Each value is bounded at 120 characters. A query string is attacker-controlled, and an unbounded one is a way to push a large payload into a stream that is supposed to carry campaign labels.
The host, and only the host
Where a referrer exists, only its hostname is taken. Never the full URL — a path can identify an individual. A referrer of the form /vendor-review/2026-q3/supplier-42/agent-assessment would tell us what someone was doing at the moment they arrived, and would tell us so accidentally, which is the worst way to learn anything.
In the other direction, this origin sends strict-origin-when-cross-origin, so a site you leave for is told which origin you came from and not which page.
Leaving this site
Following a call to action takes you somewhere else.
trustops.ecocitizenz.com
Where sign-in, accounts, Passport issuance and commerce happen. Getting a Passport means authenticating there, which is a different relationship from reading this site.
resolver.ecocitizenz.org
The public Resolver. Reads are unauthenticated and unmetered, but a request to it is still a request to it, made by your browser rather than by us.
developers.ecocitizenz.com
The Developer Gateway, where technical reference lives. Another surface, another operator relationship with your browser.
What this page does not claim
Not that there is no telemetry. There is a badge image drawn from another origin, and there may be an analytics endpoint on this one. The claim is narrower and checkable: nothing you type is transmitted, nothing identifies you across visits, and nothing third-party is loaded. If you find a place where the code disagrees with this page, that is a defect worth reporting.