Testing an AI agent means handling sensitive things: access to your systems, conversation logs and, sometimes, the weaknesses we find. This page explains how Hoqo handles them. Your Order or NDA can add stricter terms, and when it does, those apply.
1. Before testing
- We test only systems you own or have the owner's permission to test, and only after the scope is confirmed in writing.
- We sign an NDA on request before you share anything sensitive.
- We ask only for the access the agreed tests need.
2. Where we test
In order of preference: your test environment, a copy or preview of your bot, or, if neither is possible, your live agent with extra safeguards: test accounts, a set time window, a spending limit, and no irreversible actions such as real refunds, payments or emails to your customers.
3. Test accounts and credentials
- Please use accounts created for testing, with test data, not real customer accounts.
- Share credentials through a Bitwarden Send link or another method we agree on, never through our website forms or plain email.
- We store credentials only in an encrypted Bitwarden vault and ask you to revoke them when testing ends.
4. What we never do
- Test anything outside the agreed scope.
- Run load tests or attacks meant to take your service down.
- Target your staff or customers with phishing or other social engineering.
- Keep copies of real customer data. If a test exposes real personal data, we stop that test, tell you right away, and delete what we saw.
5. AI tools we use
We use automated attack scripts and AI models to generate attacks and review responses. When we send your agent's replies to an AI provider, we use the provider's business API, not consumer chat apps, under terms that do not use the data for model training. Providers we use: Anthropic and OpenAI.
Before anything is sent to an AI provider, we remove personal information about you and your customers wherever possible. Real customer data that appears during testing is never sent on to train or improve any AI model.
6. Findings and reports
- Findings, attack prompts and reports are shared only with the contacts you name.
- Reports are shared through Google Drive links that only the people you name can open, with an expiry date, and are never published.
- Confirmed critical findings are reported to you on the same business day, without waiting for the final report.
- Native-speaking partners, when used, see only what they need and are bound by a confidentiality agreement.
7. Retention and deletion
- Data you share with us, such as test accounts, logs and screenshots, is deleted within 30 days after the engagement ends: after the final retest for Scan plans, or after cancellation for Guard plans.
- During Guard, we keep the attacks that worked so we can rerun them each month. Please still revoke test credentials after each test.
- We keep the attack techniques we develop, and results with anything that identifies you, your systems or your users removed, to improve our testing. Your NDA or Order can limit this.
- On request, we confirm deletion in writing.
- Invoices are kept as Japanese tax law requires.
8. How we protect our own systems
Our devices use full-disk encryption and install operating system updates automatically, and every account we use for Hoqo has two-factor authentication turned on. Hoqo is a one-person business, so the number of people with access to your data is small by design.
9. Questions or concerns
If you have a security question, or think something went wrong, email hello@hoqo.ai. You will hear back within one business day.
END OF SECURITY & DATA HANDLING