Security and the disclosure policy

Your data lives in enterprise-grade cloud infrastructure run by established providers, the same platforms that power thousands of businesses. It is encrypted in transit and at rest, so it is protected both while it moves and while it sits stored.

Access is limited to the Susanoo people assigned to your account who need it to run your service. A specialist has access to the accounts they are on, never to all of them.

The data in your systems is yours. The leads, the contacts, the conversations, the records, all of it belongs to you, not to us. You can request a copy at any time, and if you leave you take it with you, in full, in a format you can read. The software we build is ours; your records inside it are yours.

We do not sell your data. We do not rent it, and we do not hand it to advertisers. The only outside parties who touch it are the vetted service providers we use to run the platform, and every one of them is bound to protect it and use it only to deliver the service. Your information exists to run your business. Nothing else.

The line for what AI may see and do on your account is written down in week one and kept. A person reviews the work until it earns the right not to be reviewed.

While you are a client, we keep your data to run your service. When your agreement ends, we delete or anonymize your operational data, including the personal information of your leads and customers, within 90 days. You can request deletion sooner at any time. Financial records such as invoices are retained for the period the law requires. Once data is anonymized so it can no longer identify a person, it stops being personal information.

Susanoo is a Canadian company. We operate under Canada's privacy and anti-spam laws, PIPEDA and CASL, which govern how personal information is collected, used and protected, and how marketing messages are sent on your behalf. We also serve clients in the United States, and we respect the data rights granted to their customers under applicable state privacy laws.

This is a plain-language overview, not a substitute for our Privacy Policy or Terms of Service. To access, export or delete your data, email privacy@susanoo.ai. Researching a security issue? See the vulnerability disclosure policy.

We take reports seriously and we work with you in good faith. Send reports to security@susanoo.ai.

Susanoo does not operate a bug bounty program. We do not offer money, gift cards or swag for vulnerability reports, and we will not negotiate a payment before reviewing a finding. What we offer is a real response and public credit: if you report a valid issue and want to be named, we credit you once it is fixed. We do not review reports withheld pending payment, or that arrive with a request to agree to terms before the details are shared.

• The affected URL, endpoint or component.
• Clear steps to reproduce the issue.
• The impact you observed, not the impact a scanner predicted.
• The date and time you tested, so we can match it against our logs.

Raw scanner output with no demonstrated impact is closed without a detailed response. A tool flagging something is not the same as an exploitable issue.

• susanoo.ai and its subdomains.
• The serverless functions that power our forms and gated content.
• Our client administration application.

Third-party platforms we use are not ours to fix. Report those to the vendor, and tell us anyway if it exposes our data or our clients' data.

We will not action the following without a working exploit that shows real impact: missing or misconfigured security headers; SPF, DKIM or DMARC configuration; clickjacking on pages with no sensitive state-changing action; missing rate limiting on public forms; self-XSS or attacks requiring a compromised device or physical access; denial of service, volumetric or load testing of any kind; social engineering of our staff, clients or vendors; version disclosure, banner grabbing or directory listings with no sensitive content; cookie flags on cookies that carry no authentication value; best-practice recommendations with no demonstrated exploit path.

• Test only against accounts and data you own or have permission to use.
• Stop as soon as you confirm a vulnerability. Never go further into a system than needed to demonstrate it.
• Never access, modify, download or retain data belonging to Susanoo, our clients or their customers.
• Never degrade, interrupt or damage our services.
• Give us reasonable time to fix the issue before disclosing it publicly.

If you follow the rules above and report in good faith, we will not pursue legal action against you for your research, and we will not report you to law enforcement. We consider work done under this policy to be authorized access, and if a third party brings action against you for research that stayed within it, we will make that authorization clear. This protection ends the moment research moves outside the rules above, in particular if you access or retain data that is not yours, or attempt to extract payment for withholding a finding.

We aim to acknowledge every report within five business days. We will tell you whether we consider the issue valid and in scope, let you know when it is resolved, and credit you publicly at that point if you want to be named.

This policy covers security research only. For how we handle your data, see Security and data, the Privacy Policy and the Terms of Service. A machine-readable version of this contact information is at /.well-known/security.txt.