AI Usage Policy

1. Purpose and Scope

Lorikeet Security ("we," "us," or "our") builds and operates Lory, an AI system that answers questions across our website and portals and runs autonomous penetration testing engagements against client-authorized targets. This AI Usage Policy explains how that system works, what data it processes, what a human decides, and where it can go wrong.

We publish this because we ship an autonomous agent into client networks. A customer deciding whether to let that agent near their systems is entitled to know how it works first.

This policy applies to every AI-powered feature we operate, including the website assistant, the client and partner portal assistants, the phone agent, the email agent, and the AI Pentester. It supplements our Terms of Service and Privacy Policy and is incorporated into both by reference. Where a signed Statement of Work, Master Services Agreement, or Data Processing Agreement conflicts with this policy, that agreement controls.

2. Where We Use AI

Lory operates in two roles that share a name and a persona but carry very different risk profiles.

AI is additionally used in supporting roles: enriching and classifying vulnerability findings, drafting sections of reports that a human then edits and approves, summarizing engagement activity, and maintaining our internal security knowledge base.

Where we do not use AI

• We do not use AI to make hiring, credit, insurance, pricing, or other decisions that produce legal or similarly significant effects for an individual.
• We do not use AI to decide whether a security finding is released to a client. A human does.
• We do not use AI to conduct phishing or social engineering against real people.

3. You Will Always Know You Are Talking to AI

Lory identifies itself as an AI assistant at the start of every conversation, on every channel — web chat, portal chat, phone, and email. We do not deploy AI that impersonates a named human employee.

You can ask to be transferred to a human at any time, in any channel, and we will route you to one. AI-generated content in reports and findings is labeled as AI-generated in the platform until a human reviewer approves it.

Phone calls are recorded. Recording is disclosed to all parties before it begins — in the greeting on inbound calls, and by announcement to the called party on outbound calls. If you do not consent to recording, tell us and we will end the call or continue by another channel.

4. Models and Providers

Models are selected centrally and specific model versions may change as providers release them. On a retryable provider error, a request may be retried against an alternate model of comparable capability.

We do not fine-tune models on client data. Lory's behavior comes from prompt composition over a versioned library of skill files held in source control — not from trained weights. A change to a skill file changes Lory's behavior on the next request, and those changes are tracked.

A current list of the third parties that process customer data on our behalf is available on request from security@lorikeetsecurity.com. We give customers 30 days' notice before adding a subprocessor that processes customer data; customers with a signed Data Processing Agreement may object within that window.

5. Human Oversight

The AI Pentester is not autonomous end to end. The boundary between what Lory decides and what a human decides is explicit:

The review gate

Every finding Lory produces is written in a pending review state and is invisible to the client until a human approves it. This is enforced in the data layer — client-facing queries filter on review state — not by process discipline.

A reviewer checks that the finding is real, that it reproduces from the stated steps, that it is inside the agreed scope, that the severity matches the recorded CVSS vector, that the remediation is a specific and actionable control, and that it is not a duplicate. A finding that fails any of those checks is rejected with a recorded reason and never reaches the client.

What is not reviewed before it happens

Stated plainly so nobody is surprised:

• Individual tool calls. Lory selects and runs tools autonomously within the scope gate and the non-destructive tool contracts. A human does not approve each request.
• Which attack vectors get tested. Bounded by the engagement depth cap, chosen by the engine.
• Authenticated actions. Where a client has supplied test credentials, Lory logs in and acts as that identity without per-action approval, within the agreed rules of engagement.

The controls on those are preventive — scope enforced in code, destructive flags removed, budgets hard-capped, everything logged — rather than approval-based. If you require per-action human approval, that is a human-led engagement rather than an AI one, and we offer those.

6. Authorization and Scope Enforcement

Lory tests only what a client has explicitly authorized in writing. Scope is recorded as machine-readable rules before an engagement starts.

• Scope is enforced in code, not by prompt instruction. Every tool call resolves its target and refuses unless the target matches an in-scope rule and matches no out-of-scope rule.
• Discovering a host does not make it testable. Assets found during reconnaissance are not brought into scope automatically.
• Non-destructive by default. SQL injection tooling runs in detection-only mode with no data dumping and no shell; vulnerability templates exclude denial-of-service, intrusive, fuzzing, and brute-force categories; port scanning runs no exploit scripts.
• State-changing requests are governed. The engine can send POST, PUT, PATCH, and DELETE. The rules of engagement define what is permitted — authentication flows, proving authorization boundaries, mutating objects Lory itself created — and what requires written client sign-off, including deleting objects it does not own, anything that emails, charges, or notifies a real person, and bulk writes.
• Credentials are held, not seen. Client test credentials are encrypted at rest with AES-256-GCM. The model names an identity; the platform resolves it. Secret values are redacted from tool output, logs, transcripts, and finding evidence.
• Budgets are hard caps. Iterations, tool calls, tokens, and wall-clock time are bounded per engagement depth.
• Everything is logged. Every tool invocation, its target, and its outcome are written to a per-engagement activity log that is available to the client.

7. Capabilities and Limits

What the engine can do

Enumerate DNS records, ports, and web technologies; crawl a site authenticated or unauthenticated; analyze JavaScript for endpoints and exposed secrets; discover undocumented parameters; ingest OpenAPI specifications; introspect GraphQL schemas; send arbitrary HTTP requests including authenticated state-changing ones; run detection-only vulnerability tooling; capture screenshots; and, where a client has deployed our agent, run bounded checks inside their network.

What the engine cannot do

It cannot test iOS or Android applications, perform credentialed cloud configuration review, clone or statically analyze source repositories, or conduct Active Directory–specific attacks. Engagements for those asset types are refused at request time rather than run empty — a run that probes nothing and reports nothing is indistinguishable from a clean result, which is the worst possible failure mode for a security product. Those assessments are available as human-led engagements.

What the engine does not do

It does not perform post-exploitation, establish persistence, move laterally, exfiltrate data, or conduct phishing or social engineering against real people. It validates exploitability and stops. It is an assessment tool with strong validation, not a red team.

8. Known Limitations and Failure Modes

Stated plainly, because a policy that lists only strengths is marketing.

9. Data Handling

Using an AI feature means the content of that interaction is sent to a third-party model provider for inference. What that means concretely:

• What is sent. Conversation content, engagement context, finding text, and any client data included in a prompt are sent to Anthropic for inference. Call audio and spoken text are sent to ElevenLabs for speech synthesis and recognition.
• Training. Under our commercial agreements, data we send for inference is not used to train the providers' models. We do not use client data to train any model of our own.
• Location. Model inference is performed in the United States.
• Provider-side retention of inference logs is governed by our agreements with those providers rather than by our own retention schedule.
• Redaction. Secret values are redacted from tool output, logs, transcripts, and finding evidence before storage.
• Customers who cannot send data to a third-party model provider under any terms cannot currently use Lory. We do not offer a self-hosted or air-gapped deployment today.

Retention

Test credentials are deleted immediately on request, not within the standard 30-day window. There is no reason to hold a credential a client wants gone. On termination of a client relationship, test credentials are deleted within 7 days.

Deletion requests and retention questions go to security@lorikeetsecurity.com. See our Privacy Policy for the rights available to you and how to exercise them.

10. Your Responsibilities When Using Our AI Features

When you use Lory, whether in chat, by phone, by email, through the client portal, or through our API and MCP server, you agree that you will not:

• Submit systems, domains, IP addresses, or applications for testing that you do not own or have documented written authority to have tested
• Submit personal data, protected health information, cardholder data, or other regulated data into prompts or chat beyond what is necessary and permitted for the engagement
• Submit third-party confidential information you are not permitted to disclose to a processor
• Attempt to bypass, jailbreak, or manipulate Lory's safety rules, scope enforcement, or output filters, or use prompt injection against our systems, except under an authorized security test of Lorikeet itself
• Use our AI features to develop, refine, or operate malware, ransomware, or tooling intended for unauthorized access to systems you do not control
• Use output from our AI features as the sole basis for a legal, regulatory, compliance, or contractual determination without independent human review
• Represent AI-generated output as an attestation, certification, or human-performed assessment when it has not been human-reviewed
• Scrape, resell, or redistribute our AI features or their output as a competing service

We may suspend access to AI features, without notice, where we reasonably believe any of the above is occurring, and we will tell you why.

11. Stopping AI Testing

You can stop an AI engagement at any time, for any reason, without justifying the request first.

Call if you see a service degrading during a testing window, unexpected data changes or notifications, alerts you cannot attribute, testing appearing to reach a system you did not put in scope, or anything else that makes you want it to stop — whether or not you are sure Lory caused it. A false alarm costs us five minutes; a delayed stop can cost you an outage.

A stopped engagement stays stopped until the cause is understood and written down, any fix is deployed, and you explicitly agree to resume.

If we cause impact

If Lory caused or may have caused impact to your systems, we stop everything platform-wide first, tell you what happened in plain language the same day — including the parts we do not yet understand — preserve the activity log before remediation, help you recover at our cost, and publish a written account to you within five business days. We do not bill for an engagement that caused an outage.

12. Your Controls

• Human-only engagements. You may request that your engagements be performed entirely by human testers with no AI-driven testing. This changes scope and pricing and is arranged in your Statement of Work.
• Human escalation. You may ask any Lory conversation to be handed to a person at any time.
• Recording. You may decline call recording; we will end the call or continue through another channel.
• Portal AI features can be disabled for your organization on request to your account contact.
• Access, correction, and deletion of data processed by our AI features are handled as described in our Privacy Policy.

13. What We Do Not Claim

• Lory does not certify that a system is secure. No test can.
• Lory does not replace a human penetration tester. It runs continuously between human engagements and hands everything it finds to one.
• Lory is not immune to prompt injection.
• Lory's coverage is not exhaustive. The vectors it did not reach are recorded rather than implied to be clean.
• AI output is not legal advice, regulatory advice, or a compliance attestation.

14. Governance and Measurement

Approve and reject outcomes are aggregated per skill, attack vector, model, asset type, and engagement depth to produce precision and false-positive rates. Skills that fall below the precision floor are removed from default selection. Model changes are regression-checked against the historical review corpus before rollout.

Our approach is informed by the NIST AI Risk Management Framework and the transparency and human-oversight principles of ISO/IEC 42001 and the EU AI Act. We do not claim certification against those frameworks; we claim that they shaped the controls described above.

This policy, the human-review standard, the retention schedule, and the subprocessor list are reviewed at least annually and on any material change to Lory's capabilities, autonomy boundary, or data handling.

15. Reporting a Problem

• Stop testing immediately (24/7): +1 (888) 652-6479, option 5
• Concerns about an AI output, review decision, or Lory's behavior: security@lorikeetsecurity.com
• Vulnerability disclosure, including issues in Lory itself: see /.well-known/security.txt
• Questions about a specific engagement: your Lorikeet account contact

We acknowledge reports about AI behavior within 2 business days and tell you what we found, including when the answer is that we do not yet know.

16. Changes to This Policy

We may update this policy as our AI systems change. Material changes to the autonomy boundary, the human review gate, or how data is shared with model providers will be announced to account contacts by email at least 30 days before they take effect. Non-material changes take effect on posting, with the effective date at the top of this page updated accordingly.

17. Contact

• Security and data protection: security@lorikeetsecurity.com
• General support: support@lorikeetsecurity.com
• Phone: +1 (888) 652-6479
• Website: lorikeetsecurity.com/contact