Responsible Disclosure Policy

1. PURPOSE

This policy describes how Saees coordinates responsible disclosure of security vulnerabilities and material security issues with researchers, Customers, partners, and affected providers.

2. COORDINATION

Saees may establish a confidential communication channel, assign an incident owner, validate the issue, determine impact, coordinate remediation, and identify parties that must be notified.

3. DISCLOSURE TIMING

Disclosure timing depends on exploitability, active exploitation, remediation status, legal duties, affected Customers, third-party dependencies, and risk of additional harm. Saees may delay technical details when disclosure would increase risk.

4. CUSTOMER NOTICES

Where required by law or contract, Saees will notify affected Customers or authorities through appropriate channels. Notices may describe the nature of the issue, affected data, mitigation steps, and available support.

5. THIRD-PARTY ISSUES

If an issue affects a marketplace, cloud provider, model provider, or other supplier, Saees may coordinate disclosure with that provider while protecting Customer Confidential Information.

6. CONTACT

Security reporting: security@saees.ai

Legal inquiries: legal@saees.ai

Mailing Address: Saees LLC, 4730 University Wy NE, Seattle, WA 98105