Found something in Archie, on this site, or in anything else of ours? Write to [email protected] with security in the subject line. Both of us read that mailbox.

Tell us what you found, what it lets somebody do, and how. A rough note is welcome.

Want to encrypt it? Ask in your first message and we will send a key.

What happens next

We reply within one working day to say we have it and who is looking at it.

Within five working days we tell you whether we agree it is a problem and, if we do, when we expect it fixed and in which release.

If we disagree, we say why, in enough detail that you can tell us we are wrong. After that, we write whenever something changes, including when a fix slips.

What we ask of you

  • Give us 90 days before you publish, or less once the fix ships and we tell you. If people are at risk now, say so and we will agree a shorter wait.
  • Do not test against another person’s account or data. Need an account to show something? Ask and we will make you one.
  • Do not degrade the service for other people: no load testing or automated scanning of our servers. Use your own copy of the app.

What you can expect from us

  • We will not threaten you or ask you to sign anything before we read what you sent.
  • Find something real and we name you when we write about the fix, unless you would rather we did not.
  • There is no bounty program.

Data processing agreements

Send us yours to review and sign. On your own AI account, your conversations, mail, calendar and files go from your computer to the services you connected, and we are not in that path.

What we do hold is your email address, whether you have a current plan, and the operational records listed on the Trust page. That is what an agreement with us would cover.

Our own standard agreement is not published yet. When it is, it will be linked here and name the same subprocessors as the privacy policy.

No certifications or outside audits

There is no SOC 2 report, no ISO 27001 certificate, and no HIPAA business associate agreement. Nobody outside Otian AI has audited Archie, and there has been no external penetration test.

If your policy requires a vendor certification, we do not meet it today, and our architecture document does not change that.

That document says what Archie installs, what it sends, where credentials are kept, and what it cannot do.

Revision 5, from September 3, 2026, covers Archie 0.2.3. Where it differs from the page that hands it out or the Trust page, those two are current.