AI Transparency Notice

1. Purpose

This notice explains how AI-assisted functions are used in CyfroSec services. It supplements the Privacy Policy, Platform Terms, customer agreement and Data Processing Addendum.

2. CyfroSec AI-assisted functions

Depending on the selected services, CyfroSec may provide:

• CyfroAI Engine, which performs rules-based correlation of normalised security evidence and asset or service records;
• CyfroAI Insights, which supports prioritisation, explanation and recommended next steps;
• CyfroAssistant, which supports conversational investigation, summaries, plans and proposed actions; and
• CyfroCode, which supports code-security analysis, explanations, architecture information, remediation drafts and proposed patch differences.

Not every CyfroSec function uses AI. The account, interface or Documentation identifies enabled functionality where relevant.

3. External AI processing

For enabled generative-AI functions, CyfroSec uses OpenAI Ireland Ltd. and its authorised subprocessors as an external provider. CyfroSec submits only information reasonably necessary to perform the requested function and applies data minimisation and access controls. Where technically feasible, credentials, secrets and unrelated personal data are filtered or redacted. Customers and users must avoid submitting unnecessary secrets.

Supported Responses API calls are configured with response storage disabled. API inputs and outputs are not used to train or improve OpenAI models by default unless the relevant API organisation expressly opts in. Inputs, outputs and related metadata may nevertheless be retained in abuse-monitoring logs for up to 30 days by default, subject to provider controls and legal or safety exceptions.

4. CyfroSec model improvement

CyfroSec does not use Paid Subscription Customer Data to train or fine-tune its general-purpose or cross-customer models unless the customer provides separate, express and documented written authorisation. Refusal does not affect pricing, core features or support except where an optional feature necessarily requires the authorised use.

Any authorisation must identify the data categories, model and purpose, whether the model is customer-specific or cross-customer, filtering and de-identification safeguards, retention, withdrawal mechanism and the effect of withdrawal on data already incorporated into a model.

For a free trial, CyfroSec may use filtered and de-identified trial information to improve its own detection, correlation or remediation models only where this arrangement is clearly presented before activation and the customer has an effective opportunity to opt out without penalty. Before such use, CyfroSec must apply a documented process designed to remove credentials, keys, secrets, personal data, customer identifiers and confidential business information. An opt-out applies to future collection and use. Data already incorporated into a trained model may not be technically removable; this limitation must be disclosed before trial activation.

5. Human oversight

AI output is untrusted until reviewed. It does not determine tenant scope, permissions or authorisation. An action affecting a repository, endpoint, network or production environment must pass deterministic access controls and any configured human approval.

CyfroSec does not publish a branch, pull request, commit or other repository change without the approval required by the configured workflow. Customers must review, test and approve output before implementation and remain responsible for deployment, publication or reliance on unverified output.

6. Limitations

AI and cybersecurity output may contain errors or fabricated information, omit relevant vulnerabilities or context, reproduce insecure patterns, be non-unique or similar to third-party material, change between runs or be unsuitable for a customer environment. Output is decision-support material. It is not legal advice, a compliance certification, a guarantee of security or a substitute for qualified professional judgment.

7. Prohibited uses

AI-assisted features must not be used for unlawful access, malware, harmful automation, prohibited decisions about individuals, unlawful inference of sensitive traits, circumvention of security controls or an unapproved high-risk or safety-critical context.

8. Transparency and rights

Where required and not obvious from context, CyfroSec informs users when they interact directly with an AI system. CyfroSec does not represent that AI output is produced by a human. Personal-data rights and contact information are described in the Privacy Policy.

No conformity assessment, certification or regulatory classification is represented as completed unless CyfroSec expressly confirms it in writing. CyfroSec maintains and reviews its AI-system inventory, intended purposes, role assessments, oversight arrangements and AI-literacy measures in accordance with applicable requirements.

Questions about this notice may be sent to privacy@cyfrosec.com. Security concerns should be sent to safety@cyfrosec.com.