Account Protection & Authentication
Identity is the foundation of HUMAN. We implement layered defenses to ensure the person accessing your account is legitimately you.
- Phishing-Resistant Authentication: We support modern auth pathways including WebAuthn/Passkeys, ensuring credentials cannot be easily intercepted.
- Session Integrity: Devices and active sessions are strictly monitored. Users can view and instantly revoke any active session from their security dashboard.
- Rate Limiting: Brute-force and OTP replay prevention mechanisms are embedded at the network and application layers.
Data Privacy, Confidentiality, & Encryption
We architect our systems assuming the network is hostile. Your data is isolated at the lowest levels of our infrastructure.
- Tenant Isolation: Strict Row-Level Security (RLS) ensures one user's AI or API requests can never traverse the database to read another user's private memory graph.
- Encryption: All data is encrypted in transit using modern TLS (Transport Layer Security) and at rest utilizing verified, industry-standard cryptographic algorithms.
AI Agent Permissions & User Control
Our AI orchestration operates on a strict principle of least privilege. Your personal AI cannot take consequential actions without cryptographic proof of your intent.
- Scoped Capabilities: The AI only receives the specific internal API tools necessary for the immediate task.
- Server-Side Policy Evaluation: Every AI-initiated action is independently verified by our backend systems against your predefined authorization thresholds.
Autonomous Task Execution Safeguards
We employ a Fail Closed architecture. If identity, recipient, authority, or outcome is uncertain, the AI is programmed to halt safely rather than guessing or executing broadly.
Broad instructions such as "handle my schedule" cannot silently grant unlimited financial, communication, or legal authority. High-impact operations require explicit human-in-the-loop sign-off.
Sensitive Information Handling
Your AI context windows are stripped of raw credentials. Ordinary AI planning contexts never receive raw passwords, full credit card numbers, or unrestricted provider tokens. Information is supplied to models purely on a need-to-know basis.
Connected Third-Party Services
When you connect calendars, emails, or third-party apps, HUMAN acts as a secure intermediary.
- Adversarial AI Defense: External emails and calendar invites are treated as untrusted data, not instructions. This prevents prompt injection attacks from hijacking your AI.
- Token Security: OAuth tokens are scoped to the absolute minimum required access and are stored in secure, centralized vaults.
AI Twin Identity Protection
Your AI Twin is an extension of your identity and must be rigorously protected against impersonation.
- Verified Likeness: We mandate strict identity verification before allowing the creation of synthetic digital representations or voice models.
- Bounded Agency: AI Twins cannot independently enter into binding financial contracts or deviate from approved conversational scopes.
Private Messages & Call Security
Communications traversing the HUMAN platform are strictly siloed. One user's AI cannot read or intercept another user's private information without valid, mutual authorization. Audio call transcripts are processed temporarily and subject to automated deletion lifecycles.
Location Privacy & Physical-World Safety
Live location data presents unique physical safety risks. We enforce deliberate boundaries for our map features.
- Explicit Consent: Location sharing requires deliberate activation and is separated into approximate discovery and precise tracking permissions.
- Short-lived Sessions: Live navigation sessions used to coordinate meetings automatically expire.
- Anti-Stalking Controls: Rate limits on map queries and strict block enforcement prevent proximity probing and triangulation.
Payment Security
Transactions between humans require a high-assurance financial subsystem treated separately from conversational AI.
- Tokenized Flows: All transactions rely on tokenized flows handled by PCI-compliant third-party payment processors. The AI never handles raw card data.
- Server-side Validation: Amounts, currencies, and recipient identities are cryptographically bound and validated server-side to prevent tampering.
- Idempotency: We utilize idempotency keys to ensure duplicate or uncertain charges are never blindly retried.
Fraud & Abuse Prevention
We deploy continuous monitoring for account impersonation, scam behaviors, and repeat-offender investigations. Accounts demonstrating malicious behavior or utilizing the platform to facilitate sexual exploitation, trafficking, or harassment are subject to immediate suspension, evidence preservation, and escalation to relevant authorities.
Access Controls & Infrastructure Security
Internally, HUTE engineers operate under strict Zero-Trust access controls. Production environments are segmented, and administrative activity is exhaustively audited. Secrets are actively rotated, and data minimization protocols ensure we hold only what is necessary.
Responsible Vulnerability Reporting
We actively collaborate with the security research community. If you believe you have found a security vulnerability in HUMAN, please contact our security team at [Insert Security Email]. We commit to reviewing reports promptly and providing safe harbor for good-faith, coordinated disclosure that does not impact other users' data.
Security Incident Response
We maintain a rigorous internal incident response plan covering detection, containment, investigation, and recovery. We comply fully with the Australian Notifiable Data Breaches (NDB) scheme and relevant overseas obligations to notify users transparently if their data is compromised.
User Consent, Transparency, & Control
Control remains entirely in your hands. At any point, you can review and revoke the capabilities granted to your personal intelligence. Our default-deny architecture ensures that if a permission is revoked, our systems physically reject subsequent requests for that action.