Product security
Security is an ongoing responsibility.
A clear way to report concerns. Accountable incident handling. Information that helps you protect your work.
Report a security concern
Our monitored security mailbox is the direct contact for suspected Sano Work vulnerabilities.
[email protected]Our approach
SanoAI GmbH maintains a documented product-security programme for Sano Work covering release integrity, vulnerability handling, incident response and ongoing security review. Technical evidence and accountable management oversight guide this work.
Canonical conversations and files are maintained in your selected local storage. Requested cloud functions may process selected content remotely; account, billing and operational records are handled separately. Protect your operating-system account and consider any cloud synchronization you enable for local folders.
What to include in a report
Send your report to [email protected]. The following details help us investigate:
- The affected Sano Work version and operating system.
- A clear description, expected impact and safe reproduction steps.
- A way to contact you for clarification.
Do not include passwords, private keys or other users’ personal information. Do not access other users’ data or disrupt services. Arrange a suitable transfer method with us before sending sensitive evidence. A report does not authorize testing beyond systems and data you are entitled to access.
How we respond
We review reports, assess affected versions and actual exposure, and coordinate investigation, remediation and disclosure. Relevant incidents are escalated to the responsible executive.
Affected customers will receive information on known impact, protective actions and available updates where required. We distinguish confirmed facts from matters still under investigation and update guidance as the investigation progresses.
Data-processing documentation
Our customer data-processing agreement describes the applicable processing scope, technical and organizational safeguards and arrangements for subprocessors. The relevant supplier register and contractual documents are available through [email protected]. Applicable terms depend on the agreed service and processing arrangement.
CRA reporting
SanoAI GmbH uses the official ENISA Single Reporting Platform for manufacturer notifications of reportable actively exploited vulnerabilities and severe incidents. Customers and security researchers should report concerns about Sano Work to our security mailbox above.
Responsible company
SanoAI GmbH
Wittelsbacherstr. 34
10707 Berlin, Germany
This page describes our security practices and reporting process. It is not an EU Declaration of Conformity or a certification statement.