Responsible AI Usage Policy

1. Purpose and Scope

This Responsible AI Usage Policy describes how AuthSafe may use AI-assisted tooling during software development, documentation, support operations, and internal workflows. This policy applies to all personnel, contractors, and approved contributors who use AI-generated outputs in connection with AuthSafe systems, products, or services.

2. AI Tools Covered

Covered tools include coding and content-generation assistants, including GitHub Copilot and similar large language model-based systems. AuthSafe may update this policy as additional AI tools are adopted.

3. Core Principles

• Human Accountability: AI output is assistive. Human reviewers remain fully responsible for final decisions, code quality, security, and compliance.

• Security by Default: All AI-generated code must pass secure development lifecycle checks before release.

• Privacy Protection: Sensitive data is restricted from prompts unless explicitly approved and contractually protected.

• Traceability: Material AI-assisted changes should be reviewable through normal repository, audit, and change-management controls.

4. GitHub Copilot Specific Risk Disclosures

Use of GitHub Copilot and similar tools may introduce risks, including but not limited to:

• Incorrect or Hallucinated Output: Generated code may be functionally wrong, incomplete, or misleading.

• Security Vulnerabilities: Suggestions may contain insecure patterns (e.g., injection risks, weak cryptography, improper auth/session handling).

• Intellectual Property Risk: Suggested output may resemble third-party code or patterns, creating potential licensing or attribution concerns.

• Privacy and Data Exposure: Prompt content may include confidential information if users do not apply proper data-handling controls.

• Dependency and Supply-Chain Risk: AI output may reference outdated, vulnerable, or unmaintained packages and implementation patterns.

• Bias and Quality Drift: Generated text or logic may reflect biased assumptions, stale practices, or context-inappropriate recommendations.

• Compliance Mismatch: Output may fail to meet contractual, regulatory, or internal policy requirements.

5. Mandatory Controls

• AI-generated code must undergo peer review prior to merge.

• Security scanning, dependency checks, and tests must pass before deployment.

• Developers must not paste secrets, tokens, private keys, customer personal data, or regulated data into prompts unless explicitly authorized.

• Output with potential licensing concerns must be reviewed and, where necessary, rewritten or removed.

• High-impact areas (auth, crypto, session/security controls, billing, compliance, and data export) require heightened manual review.

6. Prohibited Use

• Using AI output without human review in production-critical paths.

• Submitting confidential customer or partner information into unapproved AI systems.

• Presenting AI-generated statements as legal, compliance, or security conclusions without qualified review.

• Using AI tooling to generate malicious code, bypass controls, or violate applicable law.

7. Customer and User Disclosure

AuthSafe may use AI-assisted tooling in parts of software development and documentation workflows. AI assistance does not replace AuthSafe’s responsibility for secure engineering, validation, and contractual compliance.

8. No Warranty of AI Output

AI-generated output is provided on an assistive basis and may contain defects or omissions. Except as expressly stated in applicable agreements, AuthSafe disclaims warranties that AI-generated output is error-free, complete, non-infringing, or fit for a specific purpose.

9. Policy Updates

We may revise this policy to reflect legal requirements, technological changes, or operational needs. Updated versions will be published on this page with immediate effect unless stated otherwise.

10. Contact

For questions regarding this policy, contact support@authsafe.in.