Built for Intelligence. Designed With Security in Mind.
Security Is Part of AI Readiness
ThatWare AI is built to help organizations make their digital information more structured, accessible, and useful to intelligent systems.
That responsibility also requires protecting the systems, accounts, data, and infrastructure that make those workflows possible.
ThatWare AI combines machine-readable infrastructure, AI visibility intelligence, organizational data, and account-based workflows. Security therefore cannot be treated as an afterthought. We design the platform around layered controls intended to protect user accounts, website configurations, organizational information, generated assets, and platform infrastructure throughout the user journey.
Supporting line: Powered by ThatWare. Built around responsible data handling, secure access, human oversight, and machine-readable security governance.
Our security approach is based on five principles:
- • Protect access.
- • Minimize unnecessary exposure.
- • Secure data in transit and at rest where applicable.
- • Maintain human accountability.
- • Provide a clear path for reporting security concerns.
Security at a Glance
Use six compact trust cards immediately beneath the hero.
Secure Connections
Platform traffic should be protected using HTTPS/TLS to reduce the risk of interception while information moves between users and the service.
Controlled Access
Access to accounts, administrative systems, and sensitive operational environments should follow appropriate authorization controls.
Account Verification
Email verification and OTP-based processes help confirm account ownership during sensitive authentication workflows.
Payment Separation
Where third-party payment processors are used, sensitive card processing should remain within the payment provider's secure environment rather than being stored directly by ThatWare AI.
Human Oversight
Security-sensitive decisions and critical AI-supported workflows remain subject to human responsibility and review.
Responsible Disclosure
Researchers and users should have a clear, documented way to report suspected security vulnerabilities.
Protect the Platform Without Creating Unnecessary Friction
Good security is not only about blocking threats.
It is about ensuring that the right people and systems can access the right information while reducing unnecessary exposure.
Our approach is built around:
Least Necessary Access
Users and systems should receive only the permissions reasonably required for their responsibilities.
Separation of Sensitive Functions
Authentication, payments, platform operations, administrative access, and customer-facing functions should be logically separated where appropriate.
Secure Defaults
Security-sensitive settings should default toward protection rather than requiring users to configure them manually.
Continuous Review
Security requirements evolve as the platform, infrastructure, and threat environment change.
Human Accountability
Automated systems can detect, classify, and assist. People remain accountable for security decisions.
ThatWare's public AI policy similarly emphasizes secure environments, controlled data access, privacy, transparency, and human oversight for AI-supported workflows.
Your Workspace Starts With Secure Authentication
ThatWare AI account security may include:
Email Verification
New accounts may be required to verify ownership of the registered email address.
One-Time Passwords
Verification codes may be used for account confirmation or security-sensitive workflows.
Secure Session Management
Authenticated sessions should be protected using secure session-handling practices, appropriate expiration controls, and protected session cookies.
Login Monitoring
Suspicious authentication behavior may be monitored to identify potential misuse or unauthorized access.
Session Termination
Users should be able to end active sessions through logout, while server-side session invalidation should prevent terminated credentials from remaining usable.
OWASP recommends protecting authenticated sessions with HTTPS, secure cookies, unpredictable session identifiers, server-side invalidation, and appropriate session-management controls.
User Responsibility
Users should:
- ✓ Use unique passwords
- ✓ Protect their email accounts
- ✓ Never share OTP codes
- ✓ Log out from shared devices
- ✓ Notify us promptly about suspected unauthorized access
Your Business Data Should Be Used for a Defined Purpose
ThatWare AI may process organizational information including:
Our security model should support:
Secure Transmission
Information exchanged with the platform should use encrypted HTTPS connections.
Controlled Storage
Stored information should be protected using access restrictions appropriate to its sensitivity.
Data Minimization
Only information reasonably necessary for the relevant platform feature should be collected or retained.
Restricted Administrative Access
Internal access to customer information should be limited to authorized personnel with a legitimate operational requirement.
Retention Controls
Information should not be retained indefinitely when there is no legitimate operational, contractual, security, or legal reason to keep it.
For detailed information about collection and retention, users should be directed to the Privacy Policy.
Read Privacy Policy →Protecting Data While It Moves
ThatWare AI should use HTTPS/TLS across the platform, including authenticated areas. Transport encryption helps protect:
OWASP recommends TLS for the entire authenticated web session rather than only login pages and also recommends secure cookie attributes for session protection.
Recommended Production Controls
These should only be displayed publicly once engineering confirms they are active:
- ✓ HTTPS enforced across all routes
- ✓ HSTS
- ✓ Secure session cookies
- ✓ HttpOnly session cookies
- ✓ Appropriate SameSite controls
- ✓ Modern TLS configuration
- ✓ Automatic HTTP-to-HTTPS redirection
Protecting More Than the Login Screen
Modern SaaS applications require protection across authentication, APIs, application logic, data access, and user-generated input. ThatWare AI's engineering security program should cover areas such as:
Input Validation
Validate and sanitize submitted data before processing.
Authorization
Verify that users can access only the accounts, websites, resources, and actions they are permitted to use.
API Protection
Protect application endpoints against unauthorized access, abuse, and unexpected input.
Rate Limiting
Restrict abusive or excessive automated requests where appropriate.
Secure Error Handling
Avoid exposing sensitive application, database, or infrastructure information through user-facing errors.
Dependency Management
Monitor software dependencies for known security risks and apply appropriate updates.
Security Headers
Use appropriate browser security controls such as Content Security Policy, HSTS, anti-framing protections, content-type protections, and referrer controls where technically appropriate.
ThatWare has publicly discussed HTTPS, access control, security headers, and intrusion-prevention concepts as part of its broader web-security work.
Multiple Layers Should Protect Production Systems
ThatWare AI's infrastructure architecture should follow layered security principles. These may include:
Network Controls
Restrict unnecessary communication between systems and environments.
Environment Separation
Separate development, testing, and production environments where practical.
Administrative Access Controls
Restrict privileged infrastructure access to authorized personnel.
Logging and Monitoring
Record appropriate operational and security events for investigation and troubleshooting.
Backup Protection
Protect backup data and ensure restoration processes are appropriately controlled.
Security Updates
Apply security updates to infrastructure, frameworks, and dependencies according to risk.
Availability Protection
Design systems to reduce the impact of outages, abusive traffic, infrastructure failure, and service disruption.
Note: Do not publish specific redundancy, failover, geographic replication, or availability guarantees until they are confirmed by engineering.
AI Introduces New Risks That Traditional Web Security Alone Does Not Address
ThatWare AI works with structured organizational information, AI-generated assets, semantic relationships, retrieval resources, and AI-facing infrastructure. This requires additional safeguards.
Prompt and Input Handling
User-submitted instructions and website content should not automatically be treated as trusted commands.
Source Integrity
Structured outputs should retain clear relationships to authoritative source information where applicable.
Hallucination Awareness
Generated information should be reviewed before production deployment.
Entity Integrity
Automated workflows should avoid creating unsupported relationships between organizations, people, products, or claims.
Access Boundaries
AI processes should not receive broader account or administrative access than required.
Human Review
Critical AI-supported decisions should remain reviewable by authorized people.
ThatWare's public AI disclosure policy emphasizes that AI should not fabricate facts, invent citations, bypass privacy obligations, or eliminate human accountability.
AI-Ready Websites Also Need Machine-Readable Trust Signals
ThatWare AI's broader architecture includes machine-readable files designed to help automated systems understand a website. Security should form part of that architecture.
One important component is:
security.txt is a machine-readable file designed to help security researchers locate an organization's vulnerability disclosure information. RFC 9116 specifies that web services should publish the file under:
https://example.com/.well-known/security.txt
and serve it securely over HTTPS.
ThatWare also publishes extensive guidance describing security.txt as a machine-readable security and vulnerability-disclosure layer for modern websites.
Recommended ThatWare AI Implementation
https://thatware.ai/.well-known/security.txt
Potential fields could include:
*Only include encryption keys, acknowledgments, hiring links, or other fields if those resources actually exist.
Found Something That Does Not Look Right?
We welcome responsible reports from:
If you believe you have discovered a vulnerability affecting ThatWare AI, please report it privately before publicly disclosing technical details.
Recommended Security Contact
*If this mailbox has not yet been created, do not publish it until it is actively monitored.
ThatWare's public ethics and AI disclosure materials already support responsible reporting of suspected vulnerabilities affecting company websites, applications, infrastructure, AI implementations, and public systems.
Include
- • A clear description of the issue
- • Affected URL or feature
- • Reproduction steps
- • Screenshots or proof where appropriate
- • Potential impact
- • Your contact details
- • Any suggested remediation
Responsible Disclosure Guidelines
Security researchers should:
Avoid Harm
Do not intentionally access, alter, destroy, or expose information belonging to other users.
Minimize Data Access
Access only the information necessary to demonstrate the vulnerability.
Avoid Service Disruption
Do not conduct denial-of-service testing or activities that materially degrade the service without written authorization.
Keep Findings Private
Allow reasonable time for investigation and remediation before public disclosure.
Act in Good Faith
Security research should be intended to improve platform security, not extract commercial leverage or cause harm.
*A full Vulnerability Disclosure Policy can later exist as a separate page and be referenced here.[ci95]
Detect. Contain. Investigate. Recover.
No online service can eliminate every security risk. When a suspected security incident occurs, our response process should focus on:
1. Detection
Identify suspicious behavior or security alerts.
2. Containment
Limit potential exposure and isolate affected systems where appropriate.
3. Investigation
Determine the cause, affected systems, and potential data impact.
4. Remediation
Correct vulnerabilities and restore secure operation.
5. Recovery
Return affected systems to normal service safely.
6. Notification
Provide legally required notices to affected users or authorities where applicable.
7. Review
Use findings to strengthen future controls.
Protecting Financial Information
ThatWare AI uses external payment infrastructure for paid subscription transactions.
Where Razorpay remains the production payment provider:
- ✓ Card information should be entered within Razorpay-controlled payment flows.
- ✓ ThatWare AI should receive transaction and subscription references rather than full card credentials.
- ✓ Payment identifiers may be retained for billing, refunds, reconciliation, and support.
Protecting Financial Information
"ThatWare AI should never require users to send card numbers, CVVs, or online-banking credentials through email, chat, or support tickets."
Security Also Depends on the Services We Integrate
ThatWare AI may rely on third-party providers for functions such as:
We aim to select providers appropriate to the security and operational requirements of the service.
Each provider may operate under its own security, privacy, and compliance framework.
*Material subprocessors should ultimately be documented through a dedicated Subprocessor List or Trust Center.
What Users Can Do
ThatWare AI protects the platform, but account security also depends on users.
Customers should:
Protect Credentials
Use strong, unique passwords and secure email accounts.
Never Share OTPs
ThatWare AI representatives should never request your one-time verification code.
Review Authorized Websites
Only submit websites and information you are authorized to manage.
Validate Generated Assets
Review AI-generated files and reports before deploying them.
Remove Access When Roles Change
Ensure former employees or contractors no longer have access where applicable.
Report Suspicious Activity
Contact us promptly if you believe an account has been compromised.
Enterprise Requirements Need Deeper Controls
For Bespoke or Enterprise deployments, security discussions may include:
Do not list SSO, SCIM, SOC 2, ISO 27001, dedicated tenancy, private cloud, customer-managed keys, or data residency as available features unless they are confirmed in the production roadmap or current implementation.
We Will Only Claim Certifications We Can Verify
ThatWare AI should not display compliance or certification badges solely because they are expected of enterprise SaaS products.
Security claims should be supported by evidence.
Relevant frameworks may guide engineering practices, including:
OWASP Guidance
OWASP security guidance
RFC 9116
RFC 9116 for security.txt
Privacy Laws
Applicable privacy laws
Payment Standards
Appropriate payment-provider requirements
But following guidance is not the same as holding a certification.
Our Principle"No security theater. No unverified compliance claims."
What Security Cannot Guarantee
Security reduces risk. It cannot eliminate it.
No internet-connected platform can promise:
Absolute protection from every attack
Permanent uninterrupted availability
Zero vulnerabilities
Perfect detection of malicious activity
Complete protection from compromised user devices or credentials
Our responsibility is to maintain reasonable safeguards, improve continuously, respond responsibly, and communicate honestly.
Security & Trust Center
At the bottom, add links to:
Privacy Policy
How personal information is collected and protected.
Terms of Service
Rules governing use of ThatWare AI.
Refund Policy
Billing, cancellation, and refund terms.
AI & Ethics Policy
How ThatWare approaches responsible AI.
Vulnerability Disclosure
How to report security issues responsibly.
security.txt
Machine-readable vulnerability contact information.
Security FAQs
/.well-known/security.txt file once the security mailbox and disclosure process are operational.