# Security Policy

## Reporting a vulnerability

Please **do not** open a public GitHub issue for security vulnerabilities.

Email us at **support@m8tes.ai** with:

- A description of the vulnerability and its potential impact
- Steps to reproduce (proof of concept if possible)
- Affected versions

We'll acknowledge your report within 48 hours and aim to ship a fix within 14 days for critical issues. We coordinate public disclosure with you, typically within 90 days — sooner for critical issues, by mutual agreement. We do not currently run a paid bug bounty, but we are glad to publicly credit you for a valid report.

## Safe harbor

We will not pursue or support legal action against researchers who act in good faith and
follow this policy. To stay in good faith: only test accounts and data you own, avoid
privacy violations and any destruction or exfiltration of data, do not degrade the service
for others, and give us a reasonable opportunity to fix an issue before disclosing it
publicly. When in doubt, ask us first.

## Supported versions

We actively maintain the latest major version of the SDK. Security fixes are backported to the previous major version when practical.

| Version | Supported |
|---------|-----------|
| 1.x     | ✓         |
| < 1.0   | ✗         |

## Scope

In scope: m8tes.ai and www.m8tes.ai (the marketing site and web application), api.m8tes.ai
(the REST API), the m8tes Python SDK and CLI, the agent runtime, and platform infrastructure.

Out of scope:

- Third-party services we integrate with (e.g. Anthropic, Google, Slack, Stripe) — report those to the vendor
- Denial-of-service, volumetric, or load testing
- Social engineering or phishing of our staff, users, or contractors
- Physical attacks against offices or infrastructure
- Automated scanner output without a demonstrated, exploitable impact
- Self-XSS, and missing headers or best practices without a working exploit
- Reports against unsupported or end-of-life SDK versions

## Security & compliance

SOC 2 Type II is on our roadmap. We do not claim SOC 2 certification today. Our live
security posture and subprocessor list are published in the
**[Privacy Policy](https://www.m8tes.ai/privacy-policy)** (§7.1 for subprocessors; §8 for
data security).

How we protect your data, in brief:

- **Encryption** — TLS 1.2+ in transit; integration credentials and OAuth tokens encrypted at
  rest with authenticated symmetric encryption (Fernet — AES-128-CBC + HMAC-SHA256). User
  content (messages, run output, documents) is not separately app-encrypted at rest today.
- **Isolation** — every agent run executes in an isolated cloud sandbox; tool subprocesses
  run with a cleaned environment so credentials never reach them.
- **No training on your data** — m8tes does not use your content or outputs to train AI models.
  Model providers' training practices follow their commercial terms (see Privacy Policy §4).

Customer **[Data Processing Agreement](https://www.m8tes.ai/dpa)**, security questionnaires, or
subprocessor questions: **privacy@m8tes.ai**.