Pretty Good AI Responsible Disclosure Policy
We welcome good-faith reports that help protect our users, partners, and patients.
Looking for our HIPAA, BAA and compliance posture rather than vulnerability reporting? That lives on HIPAA compliance and security.
Security assurance
To request assurance evidence, email contact@prettygoodai.com.
- SOC 2 Type II: audited; audit report available upon request
- ISO/IEC 27001: audit report available upon request
- GDPR: aligned data handling
- HITRUST i1: certified (the bar healthcare providers are typically held to)
How to report
Email contact@prettygoodai.com with a concise description, reproduction steps/PoC, affected URLs, and impact. (Encryption optional; we currently accept plain email.)
Response targets
- Acknowledgment within 2 business days
- Status update or fix within 30 days
- Notification on remediation
Safe harbor
If you follow this policy, avoid privacy violations/service disruption, and don't access, modify, or exfiltrate PHI, we won't pursue legal action. Give us reasonable time to remediate before public disclosure.
Scope (in-scope assets)
*.prettygoodai.com*.prettygoodai.co*.prettygoodai.net
Out of scope / prohibited
- DoS, spam, or automated testing that degrades service
- Social engineering or phishing of staff/customers
- Physical attacks or testing third-party providers (e.g., Cloudflare, Google Workspace)
- Accessing or exfiltrating any PHI/PII
- Testing form submissions or creating fake requests or meeting bookings
Recognition
With permission, we may acknowledge contributors on our Security Acknowledgments page.
Contact Information
For security reports, please contact us at:
Email: contact@prettygoodai.com
Canonical: https://prettygoodai.com/.well-known/security.txt