Security starts with good habits.

1. Secure your account

Use a long, unique password that cannot be guessed from your public information. A password manager helps create and store distinct credentials for each site.

• Do not reuse a password from another service.
• Enable two-factor authentication in Settings when available.
• Never share a temporary code, even with someone claiming to be support.
• Sign out on shared devices and check for unusual activity.

If you think someone else has access to your account, change your password from a trusted device, disable suspicious sessions if that option is available, and contact support.

2. Understand the limits of AI responses

A convincing answer is not necessarily accurate, complete, or safe. Models may invent references, omit details, generate vulnerable code, or misinterpret instructions. Always review the result before using it in a real-world context.

For code, check dependencies, permissions, file access, network requests, and destructive operations. Run tests in an isolated environment before deploying anything to production.

For legal, financial, medical, or security decisions, use the answer as a starting point and confirm important details with qualified sources.

3. Protect API keys and secrets

An API key is an access credential: anyone who obtains it may be able to use your account or consume your quota. Never paste it into a message, public repository, screenshot, or configuration file sent to the assistant.

• Remplace les secrets par des valeurs fictives dans les exemples.
• Store keys in a secrets manager or an appropriate environment variable.
• Never put a private key in JavaScript sent to the browser.
• Revoke an exposed key and create a new one if needed.
• Apply the principle of least privilege to accounts and access tokens.

If you need help debugging an integration, share the error message and code structure, but remove secret values before sending.

4. Files and links: check before opening

A file from a third party may contain dangerous code, macros, deceptive links, or data you did not intend to share. Do not open an unexpected document simply because an assistant mentioned it.

Check file origins, extensions, and permissions requested by apps. Inspect archives and scripts before running them. Do not use a sign-in link received in a message unless you can verify its source.

5. Conversation data and privacy

Messages and files may be processed by the selected AI provider. Authorized administrators may also access certain information needed for operations and support. Conversations should therefore not be considered private in the same way as an end-to-end encrypted vault.

To reduce risk, anonymize documents, remove unnecessary personal information, and limit submitted content to what is strictly necessary. Read the Privacy Policy to understand the processing described by the service.

6. What service controls cannot replace

Server controls, request limits, permissions, and authentication mechanisms help protect the service. They cannot prevent every risk from a compromised device, reused password, human error, or external provider.

Keep your browser and operating system updated, avoid unknown extensions, and do not bypass security warnings without understanding their cause.

7. Report a security issue

If you discover a vulnerability or suspicious behavior, report it to support with the affected page, approximate time, reproduction steps, and observed result. Describe the issue factually and limit testing to what is necessary to demonstrate it.

Do not publish passwords, API keys, personal data, or content belonging to another user. Do not perform destructive tests, unauthorized access, or real-data collection to prove a point. Use the contact page pour rejoindre le support.

8. En cas d’incident

1. Stop the risky action immediately and keep relevant error messages.
2. Change exposed credentials and revoke compromised keys.
3. Sign out unknown sessions if that option is available.
4. Contact support with the necessary information, without including the secrets themselves.
5. Monitor sign-ins and unusual usage after securing the account.

Prompt reporting helps limit impact. This page describes recommended practices and does not guarantee that an incident can be prevented or resolved immediately.