1. Scope
This policy covers tAI, tCode, the Artfical API, ai.artfical.com, docs.artfical.com, and tai.artfical.com. A working prompt-injection technique, a tool-use scope violation, a connector permission reaching further than documented, and an infrastructure vulnerability are all in scope.
For the day-to-day process, what to report and how it's triaged, see the security docs. This page states the formal legal terms behind that process.
2. Safe harbor
Good-faith security research conducted in accordance with this policy is authorized. We will not pursue legal action against a researcher for that research, and we will consider it authorized under any relevant computer-crime law we are able to affect the interpretation of.
This safe harbor does not extend to actions that go beyond what's necessary to demonstrate a vulnerability: accessing another user's real data, degrading service, or exfiltrating data beyond a minimal proof of concept are all outside it.
3. Out of scope
- Denial-of-service testing against production infrastructure.
- Social engineering targeting Artfical staff or users.
- Physical access attempts against Artfical facilities.
- Automated, high-volume scanning that degrades service for other users.
4. What we ask of you
- Report a finding promptly, before public disclosure.
- Avoid accessing, modifying, or deleting data belonging to another user.
- Give us a reasonable window to remediate before any public disclosure, described in Section 6.
5. What you can expect from us
- Acknowledgment of your report, generally within a few business days.
- Triage using the same process described in the security docs, regardless of whether the finding came from an external report or internal red-teaming.
- Credit, if you want it, in the affected model's or product's next published revision when your report leads to a confirmed fix.
6. Disclosure timeline
We ask for a 90-day window from your initial report before any public disclosure, to give us time to confirm and remediate the issue. We'll tell you promptly if we need longer for a specific, unusually complex finding, and we won't use that request to delay indefinitely.
7. How to report
Send a report through the contact details at ai.artfical.com/about, or the address in the specific connector's own documentation if the finding is connector-specific.
8. Changes to this policy
Material changes are announced at tai.artfical.com/announcements. Prior versions are preserved at version history.
See version history for prior versions of this document, and the other pages under Terms and policies in the footer below for related terms.