Security and vulnerability disclosure

Last updated: 2026-10-28

Security is part of how ARISENTO is designed, built and released. This page summarises our approach and explains how to report a vulnerability in ARISENTO or on arisento.com.

1. How ARISENTO is secured

• Your infrastructure. ARISENTO runs on your own server or private cloud; application, database and the local AI model are not hosted by us.
• Least privilege. The application's database account cannot change, delete or truncate the audit trail or alter the database structure.
• Hardened access. HTTPS, two-factor sign-in, password policy, lockout, session lock and security headers; a credential change ends all sessions.
• Controlled AI. Local AI by default; any cloud AI provider only through QA-approved change control, with every request logged and an immediate kill switch.
• Tested releases. Automated security tests, dependency vulnerability checks and an internal penetration test before every release.

2. Report a vulnerability

If you believe you have found a security issue in ARISENTO or this website, write to support@autofai.com with a description, the steps to reproduce it and its possible impact.

• We acknowledge reports within 3 business days and keep you informed until the issue is resolved.
• Please give us reasonable time to fix the issue before you disclose it publicly.
• Do not access, change or delete data that is not yours, do not degrade the service and do not use social engineering.
• We will not take legal action against research carried out in good faith within these rules.

Machine-readable contact details: security.txt.