Responsible disclosure

Last updated 18 October 2026

If you have found a way to get at data you should not be able to see, or to do something you should not be able to do, in any 1936 AI product, we want to hear about it before anyone else does. This page says how to tell us, what we ask of you, and what you can expect from us.

What is covered

This website, 1936ai.com, including sign-up, log-in and the account page.
Our platform at api.1936ai.com.
Galley Dataroom at galley.1936ai.com.
Masthead HR and Margin Ledger, at the addresses customers use to open them.
The emails we send, and anything else that carries the 1936 AI name and that we run ourselves.

Not covered: the companies that host us (Cloudflare, Railway, Resend, Cashfree), our own accounts on other services, and anything a customer has connected to a product from their own side, such as their Google Workspace. Report a problem in a hosting company's service to that company.

How to report

Write to security@1936ai.com. Include:

what you found, in plain words, and why it matters;
where: the page or address, and which product;
how to see it ourselves, step by step, with screenshots or a short recording if that helps;
how we can reach you, and whether you would like to be named on this page once it is fixed.

You do not need to write a formal report or guess a severity. A clear description of what you saw is enough. Please send one email per problem, so each can be tracked on its own.

What we promise

A reply within one working day, from a person, saying we have received it.
Within five working days, whether we have confirmed the problem, and what we plan to do.
A fix as fast as we safely can: a problem that exposes customer data is fixed first and usually within days. We tell you when it is done, and we keep you informed if it takes longer.
No legal action against you for research done within the rules below, and no reports to the police.
If you want, your name on this page as thanks, once the problem is fixed.

We do not pay for reports yet. We are a small company and would rather be honest about that than offer rewards we cannot keep up.

The rules

So that research never harms a customer, we ask you to:

test only with accounts you created yourself, and only on your own data. If you come across someone else's data by accident, stop, do not save or share it, and tell us what you saw.
not change, delete or download anything that is not yours, and not try to stay in a system once you are in.
not overload our services, run automated scanners without limits, or disrupt anyone's use of a product.
not use social engineering, phishing or physical means against our team or our customers.
keep what you found between us until we have fixed it. Once it is fixed, you are free to write about it.
give us a reasonable time to fix it, and talk to us before telling anyone else if you feel that time has passed.

If you follow these rules, we treat your work as done in good faith, and the Terms of service clause against testing our security does not apply to you.

What we do not count as a security problem

We read every email, but these on their own will not get a fix or a mention:

findings from an automated scanner with no working example of harm;
missing best-practice settings that cannot be used to do anything, such as a header or a cookie flag on a page with nothing to protect;
that a sign-in page says whether a code was wrong, or that a password can be tried more than once (both are rate limited);
that an email could be forged from a lookalike domain, or any issue in the way email in general works;
that a watermarked document can be photographed or screen recorded, which no web product can prevent;
attacks that need someone's unlocked device, their password, or a browser extension they installed.

Who has helped

Nobody yet. The first person to report a real problem under this policy, and who wants to be named, will be here.

Our contact details for security reports are also published in the standard place, /.well-known/security.txt. For anything that is not a security weakness, such as a question about how we protect your data, read our Security page or write to hello@1936ai.com.