Legal
Security
How to report a security vulnerability to AltFn, and how Sapphire protects the data it works with.
Last updated October 20, 2026
Report a vulnerability
If you believe you have found a security vulnerability in AltFn or Sapphire, email security@altfn.ai. Describe the issue, the steps to reproduce it, the URL or component it affects, and include any proof of concept you have. Please do not report security issues through other channels.
What to expect
We read every report sent to security@altfn.ai. We will confirm that we received it, work with you to understand and fix the issue, and tell you when it is resolved.
Testing guidelines
Test only against accounts and data you own or have permission to use. Do not access, change or delete other people’s data. Do not degrade the service, which includes denial-of-service and load testing. Do not use social engineering, phishing or physical attacks. If you find an issue that exposes data, stop and report it.
Disclosure
Please give us reasonable time to fix an issue before you share details publicly. We will agree the timing of any disclosure with you.
Access follows the source
People and agents see only what they can already see in the systems Sapphire connects to. An agent acts with the access of the person who asked, never more, and payments, deletions and account changes always wait for a person.
How we handle your data
Records are scrubbed of secrets before they are kept, and every record keeps the permissions of the system it came from. We do not use your content, or anything Sapphire ingests on your behalf, to train or fine-tune machine-learning models. Sign-in runs through WorkOS, which supports your organization’s single sign-on.
Where Sapphire runs
Sapphire is deployed in a dedicated cell or inside your own environment. AltFn’s hosted service runs on Amazon Web Services in the United States (us-east-1).
Questions? Email security@altfn.ai.