Due Diligence

Why this page exists

We ask partners and agencies to trust work they can check. This page is the check, turned on our own house. It keeps three kinds of sentences separate: what we control and have done, each item verified on the date above; what we are built to meet, stated as design intent and nothing more — a standard is ours to claim only when an outside body grants it; and what is not ours to control, named plainly, because a due-diligence statement that only lists virtues is not one.

What we control, and what stands done

Mail trust. Mail from this domain is authenticated three ways: SPF names Google Workspace as the domain's sending source, DKIM is live with a 2048-bit key, and DMARC is published at the quarantine setting with aggregate reports delivered to the company.

Transport and headers. The site refuses TLS 1.0 and 1.1 and serves on TLS 1.2 and 1.3; its certificate chain verifies end to end; plain HTTP is redirected to HTTPS; HSTS is served with a one-year maximum age across subdomains. A content security policy confines the pages to their own origin, framing is denied, the permissions policy turns away camera, microphone, geolocation, payment, and USB, and the pages load third-party resources from Google Fonts only — there are no analytics or marketing trackers on this site. A path that does not exist returns an honest 404.

Reputation. On October 21, 2026, the domain was checked against the public blocklists and reputation sources that filtering gateways consult — Spamhaus, SURBL, URIBL, URLhaus, and AlienVault's Open Threat Exchange. No listing, no entry, no flag on anything checked. Cloudflare's filtered public resolvers, which refuse domains categorized as malware or adult content, return this domain's true records.

What we publish. We audit our own publications the way we audit anyone's surface. On October 21, 2026, this website was audited in full, every PDF on the company's Drive — 535 files — was inventoried against the same fences, and the site's deployment package was swept against a standing never-publish list before it could deploy. The final counts were zero in every class: no employer or bureau names, no identifier values, no internal system names or mappings, no credential material, no pointers into internal storage, and no build provenance on any public face.

A security contact. A security.txt file ships with this site, naming a monitored contact address and an expiry date a year out — and it can be read at /.well-known/security.txt.

What we are built to meet

Where any of our material names a standard, it names the standard we are designed to meet and built to exceed; we claim a standard only when an outside body grants it. A SOC 2 Type I examination is the first external examination on our roadmap, and auditor engagement is in preparation — no examination has been completed, no report exists, and nothing on this page should be read as one. Accessibility conformance with Section 508 and WCAG 2.1 AA, verified by an outside audit, is a required gate before our agency portal takes its first tenant: a commitment about sequence, not a claim that conformance exists today.

What is staged — the named remainder

Everything here is inside our control and not yet done, prepared in exact form, and printed because a reviewer could find most of it in a few minutes. We would rather name it first.

CAA. No CAA records are served for this domain today — the one gap a strict reviewer can point to in the trust set. The cure is written: eight records naming the issuing authorities our host actually uses, ready to apply at the DNS dashboard.

Mail strengthening. DMARC's reject form and SPF's hard-fail ending are written and staged as deliberate strengthenings of the live records.

Categorization. A domain registered on October 13, 2026 typically sits in the filter taxonomies as uncategorized or newly registered, and many agency policies block both classes. Recategorization requests are prepared for the ten filter vendors whose taxonomies government gateways inherit, each requesting the truthful category — Business and Technology — and accepting an artificial-intelligence category wherever one is offered. As of this statement the packet is prepared, not submitted; the ten forms execute in one attended sitting. The common thirty-day newly-registered class ages out on November 12, 2026, and the conservative ninety-day windows on January 11, 2027; no filing accelerates either clock.

Two consoles. Google Safe Browsing and VirusTotal cannot be read from our automated environment, so no verdict from either is claimed on this page. Reading them rides the same attended sitting as the categorization submissions.

A duplicate residence. A duplicate of the homepage still answers on our armor subdomain. Retiring it to a redirect is a dashboard act on our list.

What we do not have — named, not left for you to find

Added October 22, 2026. Five things a reviewer often looks for do not exist here yet, and this page names them in plain words rather than leaving them out.

No outside test of our security. No independent firm has tested our systems for weaknesses — the test the industry calls a penetration test. None has been ordered yet.

No published route for reporting a security problem. Our security contact stands in the security.txt file that ships with this site, and we read what reaches it. A fuller published policy — where to report, what to expect, and how fast we answer — does not exist yet.

No list of the companies that process data for us. We have not published a list of those companies, the list often called a subprocessor list.

No standard agreements of our own ready to sign. We hold no standard data processing agreement (a DPA) and no standard health-care partner agreement (a BAA) of our own. That is one reason the health standard elsewhere on this site is printed as not claimed.

No public status page. There is no page that shows whether our services are up or down, and no history of outages is published.

What is not ours to control

Your network's allowlist is yours. We can be correctly categorized, clean on every public list, and well-formed everywhere it is ours to be — and a given agency's gateway can still say no until its own IT desk says yes.

If your network policy blocks this site, your IT team can allowlist agenticarmorllc.com — categorized Business / Technology; the company publishes free sample editions for Medicaid agencies and describes its AI-agent services openly on the site.

Categorization is the vendor's act. We can request a category truthfully and completely; the vendor decides, on its own clock, and a request is not a result.

The truthful category, whatever it costs. An agency whose policy blocks the artificial-intelligence category outright will turn our visitors away because we told the truth about what we are. That outcome is accepted. We do not seek a category that hides the nature of the business — not here, not anywhere.

State clocks and state law. Each state runs its security review at its own pace — an arrangement can wait quarters on a review no vendor can expedite. Procurement law decides how, and sometimes whether, our services can be bought, state by state; our terms can conform to a statute, but they cannot amend one. Where software must sit in a central state catalog before an agency may use it, the listing is the state's act: we can apply, document, and wait; we cannot list ourselves. And any future federal or state rule about vendor-held Medicaid program data binds on arrival — compliance is ours; the rule is not.

The designation we do not hold. "System of record" is a formal federal designation belonging to a state's own Medicaid Enterprise System. We do not hold it and we do not imply it. Our public sentence on the point says so inside itself: Agentic Armor maintains the working compliance record for a Medicaid agency's federal requirements — its determinations, its evidence, and its attestations, kept current and exportable in full at any time. It is not a federal system of record and carries no federal designation; it is the record the agency's own staff work in every day.

The fences that do not move

Client work is never published. Our clients' audits are confidential. They are delivered to the client alone and are never published — not whole, not in part, not disguised as an example. The only audit this company will ever publish is the audit of its own estate, published by its own choice.

What we are, stated openly. Agentic Armor is an agentic-AI business. It says so on this site, in its categorization requests, and on this page.

The founder's own agency. The founder's own agency can never be a customer of this company — no offer, free or paid, direct or through a vendor, is ever made to it. That market is closed by ethics law, not by strategy, and no product decision reopens it.

Everything in our power on this estate is done, staged in exact form, or named on this page with its reason. The rest belongs to the vendors, the agencies, and time — and we would rather hand a partner this page than a promise.