# Security

Verify user identity and restrict where the agent can run.

Two kinds of control keep the agent secure: **verify who the user is** so their identity can't be spoofed, and **restrict where the agent runs** so your Agent Key can't be used on other sites.

## Verify identity

Sign the user context you pass to `identify()` so the agent trusts it. Pick one:

  
  

## Restrict where it runs

  

## Where to start

If you pass user context, add [JWT](/security/jwt/) or [HMAC](/security/hmac/) signing so it can't be forged. Then lock down the [Domain allow list](/security/domain-allow-list/).

## Compliance

Foldspace meets [enterprise-grade compliance standards](/privacy/compliance/) — ISO 27001, SOC 2, and GDPR.