Security

How to report

Write to security@arietto.com, in English or German. Please include:

• what is affected: the program (with its version: select Arietto in the Finder and choose File › Get Info), the licence service, the licence page or this website;
• what you found, and how to reproduce it;
• what an attacker could do with it, as far as you know;
• whether you know of it being used against anyone.

If a file shows the problem, attach it. Please don't send other people's personal data or scores.

What we do

• We confirm that your report has arrived within 5 working days.
• We look into it, keep you informed, and tell you when we expect a fix.
• We fix it free of charge for everyone entitled to fixes (below), and tell users what they can do in the meantime.
• If the problem is being exploited, we report it to CERT.at and the European Union Agency for Cybersecurity (ENISA), as the Cyber Resilience Act requires. The report does not name you unless you agree.
• When the fix is out, we say so on this page and, if you wish, thank you by name.

We do not pay rewards.

What we ask of you

• Give us reasonable time to fix the problem before you publish anything about it; we suggest 90 days, and we will agree a date with you.
• Don't access, change or delete other people's data, and stop as soon as you have shown the problem.
• Don't disrupt the licence service or the website for others, and don't try to trick people.
• Keep what you found to yourself and us until it is fixed.

If you report a problem to us in good faith and follow this page, we will not take legal action against you for the work that led to the report. This does not change the licence terms otherwise: in particular, nothing you find may be used to copy Arietto or to get around its licence (EULA §10).

Not covered here

• Plug-ins, language models and samples you install yourself: please report to their makers.
• Paddle's checkout and customer portal: report to Paddle.
• Problems that need someone to have full control of your Mac already.

Security fixes, and for how long

Arietto 1 gets security fixes free of charge until five years after Arietto 1 is released (EULA §6), even after a later major version has come out. You download new versions from arietto.com, and we email the address on your licence when a security fix is out.

Your data

What we do with your report and your contact details is on the privacy page.