AI Usage Policy

Last Updated: March 25, 2026

AI Usage Policy

Aribot — Cloud Security & Compliance Platform

Effective Date: [EFFECTIVE DATE]

Last Updated: [EFFECTIVE DATE]

This AI Usage Policy ("Policy") describes how Aristiun Samsad B.V. ("Aristiun," "we," "us," or "our") uses artificial intelligence technologies within the Aribot cloud security and compliance platform ("Platform"). We are committed to transparency, responsible AI use, and the protection of our customers' data.

This Policy supplements the Terms of Service, Privacy Policy, SaaS License Agreement, and Data Processing Agreement.

1. Purpose and Commitment

1.1. Purpose. This Policy provides transparency about how AI is integrated into the Aribot platform, what data is processed by AI systems, what safeguards are in place, and what rights and options are available to our customers.

1.2. Commitment. Aristiun is committed to:

  • Using AI responsibly and ethically in the context of cybersecurity;
  • Being transparent about AI capabilities and limitations;
  • Protecting customer data from unauthorized use by AI providers;
  • Complying with applicable AI regulations, including the EU AI Act;
  • Continuously improving AI accuracy and reducing risks.

2. AI Providers and Models

2.1. AI Providers. The Platform integrates the following AI providers, used exclusively for security analysis purposes:

| Provider | Model(s) | Use Case | |----------|----------|----------| | Google (Vertex AI) | Gemini 3.1 | Threat modeling, architecture analysis, compliance reasoning | | Anthropic | Claude Sonnet 4.6 | Code security review, security report generation, threat analysis | | xAI | Grok 4 | Security pattern analysis, vulnerability assessment | | OpenAI | GPT models | Supplementary security analysis |

2.2. Security Analysis Only. AI providers are used exclusively for security-related analysis within the Platform. AI is not used for:

  • Marketing or advertising purposes;
  • Behavioral profiling of users;
  • Automated decision-making with legal effects on individuals;
  • Any purpose unrelated to cloud security and compliance.

2.3. Provider Selection. We select AI providers based on: (a) model capability for security analysis tasks; (b) data protection commitments; (c) contractual guarantees regarding data usage; and (d) compliance with applicable regulations.

3. What AI Analyzes

3.1. Code Security Review. AI analyzes:

  • Code patterns and structures for security vulnerabilities;
  • Dependency configurations for known risks;
  • Authentication and authorization implementations;
  • Input validation and output encoding patterns;
  • Cryptographic usage patterns.

3.2. Threat Modeling. AI analyzes:

  • Architecture diagram metadata (component types, connections, data flows);
  • Component configurations and security properties;
  • Network topology and trust boundaries;
  • Attack surface and potential threat vectors;
  • STRIDE, MITRE ATT&CK, and other framework mappings.

3.3. Compliance Analysis. AI analyzes:

  • Cloud resource configurations against compliance frameworks (ISO 27001, PCI DSS, SOC 2, NIST);
  • Security policy implementations;
  • Compliance rule descriptions and applicability;
  • Gap analysis between current state and compliance requirements.

3.4. Risk Assessment. AI generates:

  • Threat priority scores and risk ratings;
  • Attack path probability assessments;
  • Remediation recommendations and prioritization;
  • Security posture trend analysis.

3.5. Shadow AI Discovery. AI analyzes:

  • Network traffic metadata to identify unauthorized AI service usage;
  • Endpoint patterns matching known AI service providers;
  • Usage patterns suggesting shadow AI adoption.

4. Data Sent to AI Providers

4.1. Data That IS Sent

The following categories of data are transmitted to AI providers for analysis:

  • Code snippets: Source code segments chunked for analysis. All code is preprocessed to remove secrets before transmission (see Section 4.2).
  • Architecture metadata: Component types, labels, connections, and data flow descriptions. This is structural metadata, not the actual systems being described.
  • Compliance rule descriptions: Text descriptions of compliance policies and control requirements.
  • Cloud resource configurations: Resource type, settings, and policy configurations (with secrets redacted).
  • Network traffic metadata: Domain names, endpoint patterns, and request frequency (for Shadow AI Discovery). No payload data.

4.2. Data That IS NOT Sent

The following data is explicitly excluded from AI processing:

  • API keys, tokens, and secrets: Automatically detected and stripped by our preprocessing pipeline before any data reaches an AI provider. This includes:
    • AWS access keys and secret keys
    • Azure client secrets and connection strings
    • GCP service account keys
    • OAuth tokens and bearer tokens
    • Database credentials and connection strings
    • SSH private keys
    • Generic passwords and secret patterns
  • Customer PII: Personal data of the customer's end-users is not sent to AI providers.
  • Database contents: Raw database records, backups, or dumps are never sent.
  • Raw credentials: Cloud account credentials used for API authentication are never sent.
  • Payment information: Financial data is processed exclusively by Stripe and never reaches AI providers.
  • Full source repositories: Only targeted code snippets are sent, not entire repositories.

4.3. Preprocessing Pipeline

Before any data is sent to an AI provider, it passes through our security preprocessing pipeline:

  1. Secret detection: Automated scanning for known secret patterns (regex-based and entropy-based);
  2. PII scrubbing: Detection and redaction of common PII patterns (email addresses, phone numbers in code comments);
  3. Chunking: Code is broken into analyzable segments, reducing unnecessary context;
  4. Metadata stripping: File paths and system-identifying information are generalized;
  5. Validation: Final check ensuring no prohibited data categories are present.

5. AI Provider Data Commitments

5.1. No Training on Customer Data. All of our AI provider agreements include contractual provisions explicitly prohibiting the use of customer data for model training, fine-tuning, or improvement of the AI provider's models or services. This is a non-negotiable requirement for any AI provider integration.

5.2. No Data Retention Beyond Processing. AI providers are contractually required to delete all data upon completion of each request. No customer data is stored by AI providers beyond the immediate processing of the analysis request.

5.3. Contractual Protections. Our agreements with AI providers include:

  • Data processing agreements compliant with GDPR Article 28;
  • Explicit prohibitions on using customer data for model training;
  • Data deletion requirements upon request completion;
  • Breach notification obligations;
  • Audit rights;
  • Restrictions on sub-processing.

5.4. Provider-Specific Commitments:

| Provider | Training Opt-Out | Data Retention | DPA | |----------|-----------------|----------------|-----| | Google (Vertex AI) | Vertex AI data not used for model training by default | No retention post-request | Yes | | Anthropic | Commercial API data not used for training | No retention post-request | Yes | | xAI | Enterprise data not used for training | No retention post-request | Yes | | OpenAI | API data not used for training (enterprise terms) | No retention post-request | Yes |

6. AI Output Ownership

6.1. Customer Ownership. All security findings, threat assessments, compliance reports, risk scores, remediation recommendations, and other outputs generated by AI analysis of customer data are owned by the customer. This includes:

  • Threat model reports and threat listings;
  • Compliance scan results and gap analyses;
  • Code security review findings;
  • Risk assessment scores and attack path analyses;
  • Remediation plans and security recommendations.

6.2. License to Aristiun. The customer grants Aristiun a limited license to use AI outputs for the purpose of delivering the Services, improving the Platform, and generating aggregated, anonymized insights (which cannot be traced back to any individual customer).

6.3. Report Structure. While the customer owns the content of generated reports, the underlying report templates, formatting structures, and visualization frameworks are Aristiun's intellectual property.

7. Accuracy Disclaimer and Limitations

7.1. Advisory Nature. All AI-generated security findings, risk assessments, threat analyses, and recommendations are advisory in nature. They are intended to assist security professionals, not replace human judgment.

7.2. No Guarantee of Completeness. AI analysis may not identify all security vulnerabilities, threats, or compliance gaps. The absence of a finding does not guarantee the absence of a risk.

7.3. Human Review Recommended. Aristiun strongly recommends that customers:

  • Have qualified security professionals review all AI-generated findings;
  • Validate critical findings through independent testing;
  • Not rely solely on AI outputs for security decisions;
  • Maintain their own security assessment processes alongside Platform use.

7.4. Known Limitations:

  • False positives: AI may flag issues that are not actual vulnerabilities in the customer's specific context;
  • False negatives: AI may fail to detect certain vulnerabilities, particularly novel or highly context-dependent ones;
  • Severity estimation: Risk ratings and priority scores are estimates based on patterns and may not reflect the actual impact in a specific environment;
  • Evolving threat landscape: AI models are trained on historical data and may not immediately reflect the latest threats;
  • Context sensitivity: AI operates on the data provided and may lack the full organizational context needed for perfect assessments.

8. Bias and Fairness

8.1. Awareness. We acknowledge that AI systems may exhibit biases originating from training data, model architecture, or input patterns. In the context of security analysis, this may manifest as:

  • Over-representation of certain vulnerability types;
  • Uneven detection accuracy across programming languages or frameworks;
  • Severity rating biases toward commonly documented threat patterns;
  • Platform-specific biases (e.g., better coverage for AWS vs. other clouds).

8.2. Mitigation. We mitigate bias through:

  • Using multiple AI providers to cross-validate findings;
  • Maintaining rule-based (non-AI) scanning as a complementary baseline;
  • Regular evaluation of AI output quality across different customer environments;
  • Continuous improvement of prompts and preprocessing to reduce bias;
  • Soliciting customer feedback on finding accuracy.

8.3. Reporting. Customers who identify potential AI bias in security findings are encouraged to report it to security@aristiun.com for investigation and improvement.

9. Shadow AI Discovery: Meta-Transparency

9.1. Disclosure. The Aribot Platform includes a Shadow AI Discovery feature that uses AI to detect unauthorized or unmanaged AI service usage within the customer's environment.

9.2. How It Works. Shadow AI Discovery:

  • Analyzes network traffic metadata (domains, endpoints, request patterns) to identify communications with known AI service providers;
  • Uses AI-assisted pattern recognition to detect AI service usage that may not be sanctioned by the organization's AI governance policies;
  • Reports findings to the customer's security team for review and action.

9.3. Meta-Transparency. We recognize the inherent meta-nature of using AI to discover AI. We are transparent that:

  • The Shadow AI Discovery feature itself uses AI (as disclosed in this Policy);
  • Customers are informed about AI use in Shadow AI Discovery before enabling the feature;
  • The feature provides information to empower customer decision-making, not to restrict usage autonomously.

9.4. Scope. Shadow AI Discovery analyzes network metadata only. It does not:

  • Intercept, read, or store the content of communications;
  • Block or restrict AI service usage (it reports only);
  • Monitor individual employee behavior (it analyzes organizational patterns).

10. Opt-Out Options

10.1. AI-Free Scanning. Customers who prefer not to use AI-powered analysis may request an AI-free scanning mode. In this mode:

  • Compliance scanning is performed using rule-based engines only;
  • Threat modeling uses predefined threat libraries without AI augmentation;
  • Code review relies on static analysis rules without AI interpretation.

10.2. Reduced Coverage Disclaimer. AI-free scanning provides reduced coverage compared to AI-augmented analysis. Specifically:

  • Threat detection may be limited to known patterns in threat libraries;
  • Compliance analysis may not include contextual interpretation of controls;
  • Code review may miss vulnerabilities that require semantic understanding;
  • Risk scoring and prioritization will use rule-based algorithms rather than AI models.

10.3. Requesting Opt-Out. To request AI-free scanning, contact support@aristiun.com. The opt-out can be configured at the organization level or per-feature.

10.4. Selective Opt-Out. Customers may opt out of specific AI features while retaining others. For example, a customer may disable AI-powered code review while keeping AI-powered threat modeling.

11. EU AI Act Compliance

11.1. Classification. Under the EU AI Act (Regulation (EU) 2024/1689), the Aribot platform is classified as a limited-risk AI system. Security analysis AI does not fall within the high-risk categories defined in Annex III of the AI Act, as it:

  • Does not make automated decisions with legal effects on natural persons;
  • Does not perform biometric identification or categorization;
  • Is not used in critical infrastructure control systems (it analyzes, it does not control);
  • Is advisory in nature, with human oversight as a core design principle.

11.2. Transparency Obligations. In compliance with the EU AI Act's transparency requirements for limited-risk systems:

  • This Policy discloses the use of AI in the Platform;
  • Users are informed that they are interacting with AI-generated outputs;
  • AI-generated content within the Platform is labeled as such;
  • This Policy is publicly available and regularly updated.

11.3. Risk Management. Aristiun maintains an AI risk management process that includes:

  • Regular assessment of AI output quality and accuracy;
  • Monitoring for bias, errors, and unintended consequences;
  • Human oversight mechanisms for AI-generated security findings;
  • Documentation of AI system capabilities and limitations;
  • Incident response procedures for AI-related issues.

11.4. Record Keeping. Aristiun maintains records of:

  • AI models used and their versions;
  • Data categories processed by AI;
  • Quality and accuracy evaluations;
  • Incidents and corrective actions;
  • Changes to AI systems and their impact assessments.

12. Continuous Improvement

12.1. Model Updates. AI models integrated into the Platform are updated periodically to:

  • Incorporate the latest security knowledge and threat intelligence;
  • Improve detection accuracy and reduce false positives/negatives;
  • Address identified biases or limitations;
  • Support new compliance frameworks and security standards.

12.2. No Training on Customer Data. Model updates and improvements are performed by AI providers using their own training datasets. Customer data is never used for training, fine-tuning, or improving AI models. This is a contractual guarantee with all AI providers.

12.3. Version Transparency. When significant AI model updates are deployed that may materially affect analysis results:

  • Customers are notified via release notes or email;
  • Changes in analysis methodology are documented;
  • Customers may compare results across model versions where applicable.

12.4. Feedback Loop. Customers can provide feedback on AI analysis quality through:

  • The Platform's built-in feedback mechanisms;
  • Direct communication with our security team at security@aristiun.com;
  • Quarterly business reviews (for enterprise customers).

Customer feedback is used to improve our prompts, preprocessing, and integration — not to train AI models.

13. Data Governance and Oversight

13.1. AI Governance. Aristiun maintains an internal AI governance framework that includes:

  • Designated AI responsibility within the engineering and security leadership;
  • Review and approval process for new AI integrations;
  • Regular audits of AI data flows and access controls;
  • Incident response procedures specific to AI-related issues;
  • Ethics review for new AI use cases.

13.2. Data Flow Monitoring. We continuously monitor and audit data flows to AI providers to ensure:

  • Only authorized data categories are transmitted;
  • Preprocessing pipelines function correctly (secret stripping, PII redaction);
  • AI providers comply with their contractual obligations;
  • No unauthorized data retention occurs.

13.3. Third-Party Audits. Our AI data handling practices are subject to third-party security audits as part of our overall security assessment program.

14. Contact and Questions

For questions, concerns, or requests related to AI usage in the Aribot platform:

Aristiun Samsad B.V. The Netherlands

  • AI and security inquiries: security@aristiun.com
  • Data protection inquiries: privacy@aristiun.com
  • General support: support@aristiun.com
  • Opt-out requests: support@aristiun.com
  • Website: https://aribot.ayurak.com

15. Changes to This Policy

We may update this AI Usage Policy from time to time to reflect changes in our AI practices, the addition of new AI providers, or changes in applicable law. We will notify customers of material changes by:

  • Posting the updated policy on our website;
  • Sending notification via email or in-platform messaging;
  • Providing at least thirty (30) days' notice before changes take effect.

This AI Usage Policy was last updated on [EFFECTIVE DATE].