Security Statement

Words defined in our Terms of Service and Privacy Policy have the same meaning in this Security Statement.

"Vulnerability" means a weakness in the Service that could allow unauthorized access to an Account, to Personal Data or to a Payment.

"Incident" means a breach of security that leads to unauthorized access to Personal Data or to an unauthorized Payment.

Your USDC is held in your Agent Wallet, except as described in clause 2.5. Only Your Wallet owns and controls your Agent Wallet.

Your Limits take effect when you sign them. The Network enforces the amount per Payment and the amount per day. No one can make a Payment above them.

Each Agent Address has its key held by the Wallet Provider. An Agent's requests reach the Wallet Provider through the Service, and the Wallet Provider signs the Agent's Payments and certain maintenance transactions, such as returning unused USDC to your Agent Wallet. The Network holds each Agent's Payments from your Agent Wallet to your Limits.

Bitight holds the data listed in section 3 of our Privacy Policy.

When an Agent pays a Seller, the price and its Network Fee first move from your Agent Wallet to the Agent Address, and the Agent then pays the Seller from there. This normally takes seconds. Any amount a Seller does not take returns to your Agent Wallet later. The Agent Address may keep a very small balance of USDC for Network Fees. Your Limits cap how much can move.

Your Wallet's keys and recovery phrase are held only by you. If you lose them, they cannot be recovered.

Only a new signature from Your Wallet can raise your Limits.

A Payment on the Network is final and cannot be reversed.

Your USDC stays in your Agent Wallet. The Limits you signed remain valid. Keep in your Agent Wallet only what your Agents need.

Because Your Wallet is the only owner of your Agent Wallet, its signature is enough to move your USDC back. There is no button for this, and a developer may need to help you. You will need a small amount of ETH on the Network, sent to your Agent Wallet, to pay the Network Fee.

Until you move your USDC back, do not add more.

Compromise of your chat app. Anyone with access to it can cause your Agent to pay, up to its Limits, until you turn the Agent off. If your sign-in gave us a verified email, we email you about each Payment, unless you turn these emails off.

Compromise of the Service. If the Service were compromised, false Payment requests could reach the Wallet Provider through it. The Network holds each Agent's Payments to your Limits, so such requests could pay up to the Limits you signed, and no more. This lasts until you turn the Agent off.

Service unavailable. Agents cannot pay, and an Agent cannot be turned off through the Service, until the Service returns. Your USDC and Limits are not affected.

Service Provider unavailable or paused. Agents cannot pay, and turning an Agent off may not complete until the provider returns. Your USDC is not affected.

Lower Limits reduce the amount that can be paid in the events described in clauses 5.1 and 5.2.

Compromise of Your Wallet. Anyone who obtains Your Wallet's keys or recovery phrase controls your Agent Wallet and your USDC. What they do cannot be stopped or reversed.

Pairing links. A pairing link works only while you are signed in to the Account that added the Agent; under any other Account it is refused and nothing is stored. A page that looks like ours but is not can ask for your signature, so check the address bar before you sign.

Phishing. Never give Your Wallet's keys or recovery phrase to anyone, including anyone who says they are us. Sign in only on our website and on the pages of the sign-in service you chose.

Your answers and signatures depend on the Service and on your wallet app working as intended. Limits you sign remain valid until you end them.

Section 11 of our Terms of Service describes further risks of the Network and USDC.

To report a security problem, write to support@bitight.com.

If an Incident affects your Personal Data or USDC, we will email you without undue delay. Where an Incident involves Personal Data from the European Union, we will notify the competent supervisory authority within 72 hours of becoming aware of it, where the law requires. Clause 9.2 of our Privacy Policy applies.

To report a Vulnerability, write to the address in clause 6.1 with a description, the steps to reproduce it and its likely impact. While testing, you must not access or change data of other Users, make Payments from an Account that is not yours, disrupt the Service, or disclose the Vulnerability before we have had a reasonable time to fix it.

We will not bring legal action against you for research carried out in good faith and in line with clause 6.3.

We acknowledge a report within 5 business days. We do not offer a reward.

We protect Personal Data and access to the Service with technical and organizational measures appropriate to the risk. These include protected storage of sign-in secrets, protection of sessions, two-step sign-in and limits on repeated requests.

Each Service Provider is responsible for the security of its own systems.

You must keep Your Wallet, its recovery phrase, your sign-in methods and your connected chat apps secure.

You should turn on two-step sign-in, set Limits no higher than you need, and keep in your Agent Wallet only the USDC your Agents need.

If you believe that your Account, Your Wallet or a connected chat app has been compromised, you must turn off your Agents and tell us without delay under clause 6.1.

No system is free from risk. We cannot guarantee that the Service, the Network or any Service Provider is free from unauthorized access, errors or interruption. Sections 12 and 13 of our Terms of Service apply.

We may change this Security Statement. The date at the top shows when it last changed.