KiriTTS Security Policy

Last Updated: 10 November 2026

KiriTTS welcomes reports from security researchers and will not take legal action against anyone who follows this policy in good faith.

We build text-to-speech, transcription and voice cloning services, and our users trust us with their audio, text and voice data. If you find a weakness in our systems, we want to hear about it so we can fix it before anyone is harmed.

Scope

This policy covers the systems KiriTTS owns and operates.

In scope

kiritts.com and its subdomains
The KiriTTS API and MCP server (mcp.kiritts.com)
KiriTTS user accounts, API keys and billing flows
Stored user content, including audio, transcripts and cloned voices

Out of scope

Third-party services we use, such as payment processors and hosting providers. Please report those to the vendor.
Denial-of-service attacks or anything that degrades the service for others
Social engineering or phishing of KiriTTS staff, users or contractors
Physical attacks on offices or data centers
Spam, or reports from automated scanners with no demonstrated impact
Missing security headers, missing rate limits or outdated software versions with no working exploit

How to report

Email your report to security@kiritts.com. We accept reports in English and Khmer.

A good report includes:

The affected URL, endpoint or feature
A description of the vulnerability and its potential impact
Step-by-step instructions to reproduce it
Any proof-of-concept code, screenshots or request logs
Your name or handle, if you would like credit

Please do not include other people's personal data in your report. Describe what you were able to access instead.

Research guidelines

Test only against accounts and data you own, and stop as soon as you have confirmed the issue.

We ask that you:

Use your own test accounts, API keys and voice recordings
Do not view, change, delete or download other users' data
Do not clone or generate speech in a voice you do not have permission to use
Stop and report immediately if you encounter personal data, credentials or payment details
Avoid actions that could disrupt the service, such as heavy automated scanning or bulk generation requests
Do not use a vulnerability to move deeper into our systems once you have shown it exists
Keep the details private until we have fixed the issue or agreed a disclosure date with you

Safe harbor

We consider research carried out under this policy to be authorized, and we will not pursue or support legal action against you for it.

If you act in good faith and follow these guidelines, we will:

Not bring a civil claim or file a criminal complaint over your research
Not treat your testing as a breach of our Terms of Service
Make it known that your actions were authorized under this policy if a third party takes action against you

This commitment covers only KiriTTS systems. We cannot authorize testing of third-party services, and it does not apply to activity that breaks the guidelines above. If you are unsure whether something is allowed, ask us at security@kiritts.com before you test.

What to expect from us

We will acknowledge your report within 3 business days and keep you updated until the issue is closed.

Our targets:

Acknowledge your report: within 3 business days
Confirm whether the issue is valid: within 10 business days
Send progress updates: at least every 14 days
Fix critical and high-severity issues: within 30 days
Fix medium and low-severity issues: within 90 days

These are targets, not guarantees. If a fix will take longer, we will tell you why and give you a new date.

Disclosure and recognition

We ask for 90 days from your report before you publish, and we are happy to agree an earlier date once a fix is live.

KiriTTS does not run a paid bug bounty program at this time. With your permission, we will credit you by name or handle on our acknowledgments page once the issue is resolved.

We may update this policy from time to time. The version published at kiritts.com/security-policy is the current one.