AI Transparency Notice

1. Where we use AI

VibeLock uses a large language model provided by a third party, named on our Subprocessors page, for these tasks:

• Reading the text of documents you publish into a fixed set of statements, so that fixed rules can compare them with what was verified and flag a statement the evidence contradicts.
• Drafting articles for the VibeLock blog. A person at VibeLock checks, edits and approves every article before it is published.

Security policies are filled from a fixed template using only what a scan verified. Fix prompts and click-paths are filled from a fixed library using the evidence for your finding, and finding explanations come from the same fixed catalogue. No AI model writes any of them.

Some of these features are not yet available, because they are not yet open on VibeLock. This notice describes them as designed, and we will update it before any of them changes.

2. What AI never decides

• Whether a check passed or failed, or what severity and deadline a finding has. Fixed rules decide these. Where a model reads one of your published documents, it reports only what the text says, and fixed rules make the comparison. If you think a document was misread, ask for a human review.
• Your coverage, or whether a badge criterion holds, or what your badge shows.
• Whether you own an application, or whether a scan may run.
• Anything about you as a person. VibeLock makes no decision with legal or similarly significant effects about anyone.
• What your own coding tool reports. When your coding tool scans through the MCP server, a failure it reports is recorded as reported by your tool, and a pass counts only once VibeLock corroborates it. That tool, and any AI model it uses, is yours and is governed by its own terms.

3. How AI generated content is marked

VibeLock does not use AI to write the policies it generates: they are filled from a fixed template, and each carries a notice that VibeLock did not have it reviewed by a lawyer. Articles on the VibeLock blog that were drafted with AI say so at the top of the article.

VibeLock does not currently offer a chat assistant. If we add any feature where you interact directly with an AI system, we will tell you clearly at the start of that interaction.

We provide these disclosures in keeping with the transparency duties in Article 50 of the EU AI Act. VibeLock does not use AI in any way that Article 5 of that Act prohibits, and none of the uses above is a high-risk use listed in its Annex III.

4. Your data and the model provider

• Content sent to the model provider is used to return a result and is not used to train models. The provider may keep it for a limited period for safety and abuse monitoring under its commercial terms, and then deletes it. VibeLock does not keep a separate copy of what was sent.
• Code read from your repository is checked by fixed rules only. VibeLock does not send your code to an AI model.
• When your coding tool scans through the VibeLock MCP server, your code stays on your machine. The coding tool, and any AI model it uses, is yours and is governed by its own terms.

5. Asking for a human review

If you think a finding, an explanation or a contradiction flag is wrong, you can dispute it from your dashboard, or email hello@vibelock.ai. A person at VibeLock reviews it, and we aim to reply within 2 business days. You can also rescan at any time. You can never be asked to accept an AI result as final.

6. If you publish generated content

If you publish a policy that VibeLock generated from its template, you are its publisher. Review it, make it accurate for your business, and have it checked by a qualified person where it matters.