🛡️ Security & Use Disclaimer

1. Security Overview

This Security & Use Disclaimer outlines important security considerations, limitations, and user responsibilities when using InkDecoder's AI-powered document transcription service. Your security and privacy are important to us, but you must understand the inherent risks and limitations.

1.1 Security Risk Classification

We classify security risks as follows:

• High Risk Critical security vulnerabilities or data exposure risks
• Medium Risk Moderate security concerns requiring user attention
• Low Risk Minor security considerations with minimal impact

2. Data Security Disclaimers

2.1 Data Transmission Security Medium Risk

Data transmission risks include:

• Network interception by malicious actors
• Man-in-the-middle attacks on compromised networks
• DNS poisoning or routing attacks
• Government surveillance or interception
• ISP logging or monitoring activities

2.2 Data Storage Security Medium Risk

While we implement industry-standard security measures, we cannot guarantee absolute protection against:

• Advanced persistent threats (APTs)
• Zero-day vulnerabilities in our infrastructure
• Insider threats or unauthorized access
• Cloud provider security breaches
• Physical security compromises
• State-sponsored cyber attacks

2.3 Image Processing Security Low Risk

3. Document Handling & Privacy

3.1 Sensitive Document Warnings High Risk

3.2 Document Redaction Requirements

Before uploading documents, users must:

• Redact or remove all sensitive personal information
• Obtain proper authorization for processing confidential materials
• Ensure compliance with data protection regulations (GDPR, HIPAA, etc.)
• Verify they have the legal right to process the documents
• Consider the potential impact of data exposure

3.3 Metadata and Hidden Information Medium Risk

Document images may contain hidden metadata including:

• Camera EXIF data with location information
• Device identifiers and timestamps
• Software version information
• Previous editing history or layers
• Embedded text or annotations not visible in the image

4. Third-Party Service Risks

4.1 AI Processing Risks Medium Risk

Third-party AI processing risks include:

• Data retention policies of AI providers
• Model training on user-submitted content
• Jurisdictional differences in data protection laws
• Potential AI provider security breaches
• Changes in third-party privacy policies
• Government access to third-party data

4.2 Payment Security Low Risk

Payment processing through Stripe creates additional security considerations:

• Financial data is handled by Stripe, not InkDecoder
• Payment information may be subject to different jurisdiction laws
• Transaction logs may be retained for financial compliance
• Chargeback disputes may expose some account information

4.3 Infrastructure Dependencies

Our service relies on various third-party infrastructure providers, creating potential points of failure or security compromise in the supply chain.

5. User Security Responsibilities

5.1 Document Security Assessment

Users are solely responsible for:

• Conducting security risk assessments before uploading documents
• Determining the appropriate classification level of documents
• Ensuring compliance with organizational security policies
• Obtaining necessary approvals for document processing
• Implementing additional security controls when required

5.2 Access Control High Risk

User access control responsibilities:

• Use strong, unique passwords for accounts
• Enable two-factor authentication when available
• Monitor account activity for unauthorized access
• Log out from shared or public computers
• Regularly review and audit account permissions
• Report security incidents immediately

5.3 Network Security

Users should:

• Use secure, trusted networks for sensitive document processing
• Avoid public Wi-Fi for confidential document uploads
• Consider using VPN services for additional protection
• Ensure endpoint security on devices accessing the service
• Keep browsers and security software updated

6. Prohibited Content & Usage

6.1 Strictly Prohibited Uses High Risk

6.2 Regulated Content Restrictions

Users must not upload documents containing:

• Export-controlled technical information (ITAR, EAR)
• Classified government or military documents
• Protected financial information (credit cards, bank accounts)
• Copyrighted material without proper authorization
• Personal data of minors without parental consent
• Information subject to legal privilege or confidentiality

6.3 Defensive Security Applications

Acceptable defensive security uses include:

• Digitizing security policies and procedures
• Processing incident response documentation
• Analyzing threat intelligence reports
• Digitizing security audit findings
• Processing security training materials
• Converting security compliance documentation

7. Account Security Warnings

7.1 Authentication Security Medium Risk

Authentication security risks:

• Brute force attacks on weak passwords
• Credential stuffing from other breached services
• Session hijacking on unsecured networks
• Social engineering attacks targeting account recovery
• Keylogger malware capturing credentials

7.2 Session Security

Users should be aware of session security risks:

• Session tokens may be vulnerable to theft or replay attacks
• Prolonged sessions increase exposure window
• Shared computer usage may leave session data
• Browser vulnerabilities may expose session information

7.3 Account Monitoring

Users should regularly monitor for:

• Unusual login locations or times
• Unexpected document processing activity
• Changes to account settings or preferences
• Suspicious email notifications
• Unauthorized subscription changes

8. Network & Transmission Security

8.1 Network Vulnerabilities Medium Risk

Network-based security risks include:

• Public Wi-Fi Risks: Unencrypted or compromised public networks
• Man-in-the-Middle Attacks: Interception of data transmission
• DNS Attacks: Redirection to malicious servers
• BGP Hijacking: Route manipulation for traffic interception
• SSL/TLS Vulnerabilities: Weak cipher suites or certificate issues

8.2 Corporate Network Considerations

Corporate network factors:

• Deep packet inspection may expose document content
• Corporate proxies may cache or log transmitted data
• Network access controls may block service functionality
• Compliance monitoring may flag document uploads
• Shadow IT policies may prohibit cloud service usage

8.3 International Data Routing

Data may traverse multiple international jurisdictions during transmission, subject to various:

• Government surveillance programs
• Data localization requirements
• Varying privacy protection standards
• National security restrictions
• Cross-border data transfer regulations

9. Compliance & Regulatory Disclaimers

9.1 Regulatory Compliance Responsibility High Risk

Compliance considerations include:

• GDPR: European data protection regulations
• HIPAA: Healthcare information privacy (US)
• SOX: Financial reporting requirements (US)
• ITAR/EAR: Export control regulations (US)
• PCI DSS: Payment card data security standards
• ISO 27001: Information security management standards
• Industry-specific regulations: Banking, healthcare, government, etc.

9.2 Audit and Compliance Monitoring

InkDecoder does not provide:

• Compliance certification or attestation services
• Audit trails for regulatory compliance purposes
• Data residency guarantees for specific jurisdictions
• Legal advice regarding regulatory compliance
• Compliance monitoring or reporting services

9.3 Cross-Border Data Transfer Compliance

Users must consider:

• Data localization requirements in their jurisdiction
• Cross-border data transfer restrictions
• Adequacy decisions for international data flows
• Standard contractual clauses requirements
• Binding corporate rules compliance

10. Security Incident Response

10.1 Incident Reporting

Report security incidents including:

• Suspected unauthorized access to accounts
• Unusual system behavior or errors
• Potential data breaches or exposures
• Malicious activity or attacks
• Vulnerability discoveries
• Compliance violations

10.2 Incident Response Limitations

Our incident response capabilities are limited to:

• InkDecoder-controlled systems and data
• Incidents directly affecting our service
• Best-effort notification of affected users
• Coordination with law enforcement when required

We cannot provide incident response for:

• User device or network compromises
• Third-party service security incidents
• User-caused security violations
• Incidents outside our technical control

10.3 User Incident Response Responsibilities

Users must:

• Maintain their own incident response capabilities
• Have procedures for potential data exposure incidents
• Be prepared to notify relevant authorities as required
• Maintain adequate cyber insurance coverage
• Have backup and recovery procedures in place

11. Security Limitations

11.1 Technical Security Limitations

InkDecoder's security is limited by:

• Current state of cybersecurity technology
• Third-party service provider security capabilities
• Cloud infrastructure security limitations
• Budget and resource constraints
• Threat landscape evolution
• Regulatory and legal compliance requirements

11.2 No Security Guarantees High Risk

11.3 Evolving Threat Landscape

Security threats continuously evolve, and new vulnerabilities may be discovered that affect:

• Our service infrastructure and applications
• Third-party dependencies and integrations
• Encryption and security protocols
• AI processing systems and models
• User devices and networks

12. Recommended Security Practices

12.1 Document Security Best Practices

We recommend users:

• Classify Documents: Assess sensitivity before upload
• Redact Sensitive Information: Remove PII and confidential data
• Use Secure Networks: Avoid public Wi-Fi for sensitive documents
• Verify Authorization: Ensure you have rights to process documents
• Monitor Usage: Regularly review account activity
• Backup Important Data: Maintain local copies of critical transcriptions

12.2 Account Security Best Practices

• Use strong, unique passwords with password managers
• Enable two-factor authentication when available
• Regularly review and audit account access
• Log out from shared or public devices
• Keep contact information updated for security notifications
• Monitor account statements and usage reports

12.3 Organizational Security Practices

Organizations should:

• Develop clear policies for cloud service usage
• Conduct security risk assessments
• Provide security training for users
• Implement data loss prevention (DLP) controls
• Maintain incident response procedures
• Consider additional encryption for sensitive documents

13. Security Contact Information