Security at Piscys

Last Updated: September 20, 2026

Piscys is building infrastructure for high-stakes AI governance and assurance. We apply security practices appropriate to our current stage, architecture, and risk profile, and we are committed to improving those controls as the platform develops.

1. Security Contact

For security-related inquiries, vulnerability reports, or responsible disclosure matters, please contact rolland.swing@piscys.ai.

2. Responsible Disclosure / Vulnerability Reporting

We welcome good-faith security research and reports from security researchers, customers, partners, and other users. If you believe you have identified a security vulnerability affecting Piscys or a Piscys-operated service, please email rolland.swing@piscys.ai and include, where possible:

• A clear description of the issue and its potential impact
• Steps to reproduce the issue, including proof-of-concept material where appropriate
• The affected URL, endpoint, system, or component
• Contact information so we can follow up with you

What You Can Expect From Piscys

We will make reasonable efforts to:

• • Acknowledge receipt of a security report within a reasonable period.
  • Investigate and validate reported issues based on severity, reproducibility, and potential impact
  • Prioritize remediation according to risk and operational constraints
  • Keep reporters informed of material progress where appropriate
  • Coordinate responsible public disclosure timing when feasible

Responsible Research Guidelines

To support safe and responsible research, please:

• • Do not exploit a vulnerability beyond what is reasonably necessary to demonstrate its existence or impact
  • Do not access, modify, copy, retain, or disclose data that does not belong to you
  • Do not perform denial-of-service, load testing, automated high-volume scanning, or other activity that could disrupt Piscys systems without prior written authorization
  • Do not use social engineering, phishing, physical intrusion, or attacks against employees, contractors, customers, or partners
  • Make a good-faith effort to avoid privacy violations, degradation of service, destruction of data, or interruption of operations
  • Give Piscys a reasonable opportunity to investigate and remediate an issue before public disclosure

3. Safe Harbor for Good-Faith Security Research

Piscys intends to support good-faith security research conducted in accordance with this policy. If your research complies with these guidelines, Piscys will not initiate legal action against you solely for that research.

This safe harbor does not apply to conduct involving extortion or ransom demands; intentional destruction, alteration, or exfiltration of data; intentional service disruption; social engineering; physical attacks; unauthorized access to facilities; or other activity conducted in bad faith or outside the scope of this policy.

4. Bug Bounty

Piscys does not currently operate a public bug bounty program or offer monetary compensation for vulnerability reports. If we introduce a bug bounty program in the future, its scope, eligibility requirements, rewards, and terms will be published separately.

5. Security Notifications

If Piscys identifies a material security incident affecting customers, users, or personal information, we will evaluate appropriate notification and remediation steps in accordance with applicable contractual and legal requirements. Depending on the circumstances, this may include direct notification to affected parties and/or updates through appropriate Piscys communication channels.

6. Security Practices

Piscys is developing its security program alongside the platform and intends to apply administrative, technical, and organizational safeguards proportionate to the sensitivity of the systems and information involved. These practices may include access controls, secure development practices, vulnerability management, logging and monitoring, encryption, change controls, and incident-response processes as appropriate to the platform’s stage of development.

No system can be guaranteed to be completely secure, and this page should not be interpreted as a representation that any particular control or certification is currently implemented unless explicitly stated.