Trust and security

Report a security problem

Email heirlifestyle@gmail.com. We reply within 2 business days. We will not take legal action against good-faith research that follows our policy below.

Machine-readable contact: /.well-known/security.txt

How we protect you

• The free tools stay on your device. Our pages can't send what you type anywhere: the browser blocks it (Content-Security-Policy connect-src 'none'). Nothing leaves until you press Open in Claude, Open in ChatGPT or Share.
• The Studio runs on your own server. We never receive your data. It is encrypted at rest with AES-256-GCM, using your own key.
• Sign-in: company single sign-on, or passwords plus two-step codes from an authenticator app. Accounts lock after repeated wrong tries.
• A tamper-evident audit log records every sign-in, run, approval and setting change, with the exact model and prompt version.
• The Safe-Paste Screener removes hidden characters and flags hidden commands before anything reaches the AI.
• People stay in charge. Nothing is sent or published without a named approver. An admin can stop all AI calls instantly.
• Signed files. Our pages and documents carry Ed25519 signatures. Check them with our public key.

For security and procurement teams

The Security Packet (26 pages) holds the white paper, our answers to standard security questionnaires, the AI governance statement and AI system card, the incident response plan, this disclosure policy, and our support terms. It also comes with a software bill of materials: the full list of what's inside the software, which has zero outside packages.

Signatures: packet .sig · bill of materials .sig

Vulnerability disclosure policy

We welcome reports from security researchers and customers. If you find a flaw, tell us first so we can fix it before it harms anyone.

What's in scope

• The Intelligent Talk Studio software (all released versions).
• Our website, intelligenttalk.pages.dev, including the free translator.
• The signed release files and our published signing key.

Out of scope:

• Payhip, PayPal, Stripe, Cloudflare, YouTube, Anthropic and OpenAI systems. Report those to the company that runs them.
• Denial-of-service tests, spam and social engineering of people.
• Reports from automated scanners with no proof of a real problem.

How to report

Email heirlifestyle@gmail.com. Please include:

• what you found and where (version or page)
• steps to reproduce it
• what an attacker could do with it
• your name or handle, if you'd like credit

Please don't include anyone's real personal data. If you happen to see some, stop, don't keep it, and tell us.

What we promise

Step	Our target
Confirm we received your report	Within 2 business days
First assessment and severity	Within 5 business days
Fix for a Critical flaw	Within 14 days
Fix for High	Within 30 days
Fix for Medium or Low	Within 90 days

We'll keep you updated, tell you when it's fixed, and credit you in the advisory if you want.

Safe harbor

If you act in good faith under this policy, we will not take legal action against you or ask anyone else to. Good faith means you:

• test only against your own copy of the Studio, or pages that are open to the public
• don't access, change or delete other people's data
• don't harm service for others
• give us a reasonable time to fix the flaw before telling anyone else; we suggest 90 days, or sooner once a fix ships

We can't authorize testing of systems other companies own.

Rewards

We don't run a paid bug bounty today. We say thank you publicly, with your OK.

Machine-readable contact: /.well-known/security.txt (RFC 9116).