Security

If you believe you have found a security vulnerability in Arbium, please tell us. You do not need an account, a support contract, or an existing relationship with us to report something.

1. Reporting a vulnerability

Email security@arbium.ai.

Send whatever you have. None of the following is required, but each one helps us act faster: what you found and roughly where, the steps to reproduce it, and what an attacker could do with it.

Please report the issue to us before sharing it publicly, and please avoid accessing, modifying, or retaining anyone else's data while you investigate. We will not pursue legal action against anyone acting in good faith under this guidance.

2. What happens next

We acknowledge every report within 2 business days, and tell you our assessment — including whether we are treating it as a vulnerability — within 10 business days. We keep you updated while we work on a fix, and tell you when it ships.

We are glad to credit you when we publish a fix, if you would like us to.

3. Reporting other problems

The same address is the right one for any operational or security failure, outage, suspected incident, or complaint about how the Service is handling data — not only for vulnerabilities. Write to security@arbium.ai.

For questions, complaints, or requests about your own data, contact help@arbium.ai, or use the options under Settings → Your data in the Arbium desktop app. Privacy-specific enquiries can also go to privacy@arbium.ai.

4. Machine-readable details

Our disclosure contact is also published at /.well-known/security.txt, following RFC 9116.