AI / Responsible Use

LaunchSafe builds autonomous security agents. They read code, reason about vulnerabilities, and exercise them. That is genuinely dual-use, and we would rather be explicit about how we handle it than leave it implied.

Your data is not our training data

We do not train or fine-tune models on customer code, configuration, findings, prompts, outputs or runtime telemetry. Inference runs under zero data-retention terms with our model providers. Prompts and outputs are treated as customer data under the Data Processing Agreement, and nothing is shared between tenants.

Where we would like to use something you have sent us to improve a model, we ask first, in writing, per customer. Silence is not consent.

Humans stay in the loop

• Read-only analysis runs autonomously within the scope you set.
• Anything intrusive or state-changing — exploitation, writes, configuration changes, credential use — sits behind an explicit approval gate before it executes.
• Scope is enforced by deterministic controls in the product, not by asking the model to behave. Allow-lists, rate limits and blast-radius caps are checked outside the model's reasoning path, and the model cannot widen them.
• Every agent action is logged with its inputs, a reasoning summary and the result, so you can audit what ran and why.

Where it runs

You choose. The platform can run in our multi-tenant cloud, pinned to a single region, in a dedicated environment, or entirely inside your own VPC so that code and runtime data never leave your network.

What we will not do

• Ship capability intended for use against systems the user is not authorised to test. Authorisation obligations are in the Acceptable Use Policy.
• Release fully autonomous exploitation against production without a human approval step.
• Sell or license offensive capability to buyers we cannot verify, or into sanctioned jurisdictions.
• Publish working exploit code for an unpatched vulnerability in someone else's product. We disclose to the vendor first, as described in our Vulnerability Disclosure Policy.

How we evaluate

Before a model or agent ships we run capability and safety evaluations covering refusal behaviour on unauthorised-target requests, scope adherence under adversarial prompting, prompt-injection resistance when reading untrusted code and web content, and the rate of destructive actions attempted without approval. Results gate the release, and we re-run them on every model change rather than only on major versions.

We align our practice with established frontier-safety and responsible-scaling guidance, and we participate in the Anthropic Cyber Verification Program.

Limits you should know about

Security testing is probabilistic. Our agents will miss things, and they will sometimes report findings that turn out to be wrong. Treat the output as evidence for a human decision, not as a verdict, and do not make it the only control on a system where failure causes physical harm.

Reporting a concern

If you think one of our agents behaved unsafely, exceeded its scope, or produced something it should have refused, tell us at hello@launchsafe.com. We treat those reports with the same urgency as a security vulnerability.