Security Policy

1. Overview

This Security Policy describes the security commitments Ventureship makes for SME AI and how security researchers and users can report concerns. For a plain-language overview, see our security page.

2. Our commitments

• Encryption in transit. The Services are delivered over encrypted connections.
• Access control. Access to customer data is role-based and limited to what each person needs. Elevated administrative access can only be granted by a small group of senior administrators.
• Data separation. Each business can access only its own data within the Services, and partners can access only information related to their credited leads.
• Account protection. Separate sign-in experiences for businesses, partners and staff, with secure password reset.
• Payment safety. Card details are collected on secure checkout pages provided by payment processors rather than in conversations.
• Activity records. Significant activity such as conversations, payments and handoffs is recorded so it can be reviewed.
• Vendor diligence. We select service providers with appropriate security practices and bind them to protect data.

3. Your part

Security is shared. Please use a strong, unique password, keep your sign-in details private, give team members only the access they need and let us know promptly if you notice anything unusual in your account.

4. Responsible disclosure

If you believe you have found a security vulnerability in SME AI, please report it to us through our contact page with the topic “Legal, privacy or security”. Include enough detail for us to reproduce the issue.

When researching, please:

• Act in good faith and avoid privacy violations, data destruction and service disruption.
• Only interact with accounts you own or have explicit permission to access.
• Do not use automated scanning that degrades the Services, social engineering or physical attacks.
• Give us reasonable time to address the issue before sharing it publicly.

We will acknowledge good-faith reports, keep you informed of our progress where we can and will not pursue action against research conducted in line with this policy.

5. Incident response

If we become aware of a security incident affecting your data, we will investigate, take steps to contain it and notify affected customers without undue delay as required by law and our agreements.