AI Addendum
This AI Addendum supplements the agreement governing Customer’s use of Bright’s Services, whether Bright’s Terms of Service or another agreement between the parties (the “Agreement”). For purposes of this AI Addendum, “Bright” means the Bright entity that is a party to the Agreement, and “Customer” means the customer entity that is a party to the Agreement. This AI Addendum applies to the AI Assistant (“Stella”) (if activated by Customer), AI Pentesting (“AI PT”) (if procured by Customer) and any other functionality that Bright expressly designates in an Order or the Documentation as subject to this AI Addendum (collectively, “AI Features”).
Capitalized terms not defined here have the meanings given in the Agreement. The Agreement otherwise remains unchanged.
Bright may update this AI Addendum from time to time, subject to the Agreement. Material changes will be communicated to Customer through the Platform, by email, or on Bright’s website. Continued use of the applicable AI Features after such changes become effective constitutes Customer’s acceptance of the updated AI Addendum.
1. AI Features and Providers
1.1 AI Features
Bright may make available AI Features that use artificial intelligence models and related technologies to generate content, analyze or retrieve information, interact with Customer Data, invoke Platform functionality or tools, and perform other functions described in the applicable Documentation. The functionality, capabilities and level of automation of each AI Feature may vary.
Certain AI Features, including AI PT, may require separate purchase and will be available only if included in Customer’s Order, subscription or other commercial arrangement with Bright.
1.2 AI Providers
Bright may use third-party AI models, infrastructure and related services (“AI Providers”) to provide AI Features.
Bright’s use of an AI Provider selected by Bright does not relieve Bright of its obligations under the Agreement or applicable law, subject to the exclusions and limitations of liability set forth in the Agreement.
1.3 BYOK
Where supported, Customer may use its own AI Provider account or API key (“BYOK”) with an AI Feature. Bright is not required to support BYOK for any particular feature, provider or model.
Customer is responsible for its selected AI Provider’s fees, terms, usage limits and data processing, security, retention and training practices, and authorizes Bright to use the Customer-provided account or key to provide the AI Feature.
Bright is not responsible for a Customer-selected AI Provider’s availability, acts or omissions, except to the extent resulting from Bright’s breach of this AI Addendum or the Agreement.
A BYOK AI Provider is not a Bright Subprocessor solely by reason of its integration with the Services.
Use of BYOK does not modify any scope limitations, safeguards, permissions, usage restrictions or other requirements applicable to the relevant AI Feature.
2. Customer Data and AI Output
2.1 AI Input and AI Output
An “AI Input” is information provided to or retrieved by an AI Feature, including prompts, Customer Data and other context. An “AI Output” is content, recommendations, findings or other results generated by an AI Feature.
AI Input comprising Customer Data, and AI Output generated specifically for Customer, will be treated as Customer Data under the Agreement, excluding Bright technology, Documentation and pre-existing materials. AI Output may not be unique and similar output may be generated for others.
2.2 Processing of Customer Data
To provide an AI Feature, Bright may access, retrieve and transmit relevant Customer Data to applicable AI Providers. Depending on the AI Feature and Customer’s use of the Services, this may include information relating to Customer’s applications, systems, and security testing activities and results, including Personal Data incidentally encountered during such activities.
By enabling or using an AI Feature, Customer authorizes and instructs Bright to process such Customer Data as reasonably necessary to provide that AI Feature.
2.3 Model Training
Bright will not use Customer’s non-public Customer Data to train or improve AI models or machine-learning systems, and, where Bright selects the AI Provider, will use services under which such data is not used by the AI Provider to train or improve its AI models or machine-learning systems.
Where Customer uses BYOK, the applicable AI Provider’s use, retention and processing of Customer Data, including for model training or improvement, will be governed by Customer’s agreement with and configuration of that AI Provider.
2.4 AI Records
Bright may maintain AI interaction, usage and action records as reasonably necessary to operate, secure, troubleshoot, audit and bill for AI Features, subject to the Agreement and applicable law.
3. AI Assistant
3.1 AI Assistant
The “AI Assistant” is an agentic conversational feature that may use Bright Documentation, Customer Data and Platform functionality to respond to Users and, where supported, invoke APIs or other tools on Customer’s behalf.
3.2 User Permissions
The AI Assistant is intended to operate only within the permissions of the applicable User.
3.3 AI Actions
The AI Assistant may take actions within the Platform (“AI Actions”). AI Actions are separate from AI Output. An AI Action initiated in response to instructions submitted through an authenticated User account will be treated as requested and authorized by Customer, subject to any approval, confirmation or other safeguards implemented by Bright.
Bright may require User approval for particular AI Actions or restrict actions available to the AI Assistant.
3.4 AI Assistant Usage Limits
Use of the AI Assistant is subject to usage limits or allowances determined by Bright and specified in the applicable Order, subscription plan, Documentation or Platform. Unless otherwise agreed, such limits apply in the aggregate to Customer’s organization.
Upon Customer reaching the applicable usage limit, further use of the AI Assistant will be suspended. Customer may purchase additional usage packages or allowances, if made available by Bright, to resume use. Any such additional usage will be subject to the applicable fees and terms communicated by Bright.
4. AI Pentesting
4.1 AI PT
AI PT performs autonomous or semi-autonomous security testing within a scope selected or approved by Customer, including reconnaissance, vulnerability scanning, validation and exploitation attempts.
Customer authorizes such activities within the approved scope, and Bright will use commercially reasonable efforts to keep testing within that scope.
4.2 AI PT Authorization and Scope
Customer represents and warrants that it has all necessary rights and permissions, including third-party authorizations, for Bright and its subcontractors to test each system, application or other asset designated by Customer (each, a “Target”). Customer will accurately define the Targets, testing scope and any restrictions. Bright may rely on this information without independent verification and may request written confirmation of authorization. Customer shall indemnify Bright against third-party claims arising from its failure to obtain such rights or permissions, subject to the indemnification provisions of the Agreement.
Unless the Parties expressly agree otherwise in writing, AI PT may be used only in non-production environments without live user data or material risk to live operations.
4.3 AI PT Safeguards and Restrictions
Bright may impose technical safeguards, testing boundaries, approval requirements, rate or step limits, prohibited actions, stop conditions and other controls applicable to AI PT. Customer will not circumvent such controls.
Customer will promptly notify Bright of any material adverse effects of AI PT of which it becomes aware.
Bright may pause, restrict or discontinue AI PT if it identifies a serious incident, a scope concern or an operational risk.
4.4 AI PT Risks
Customer acknowledges that autonomous AI PT may involve unpredictable or rapid testing activity and may cause performance degradation, interruptions or unintended changes to or loss of data. Customer is responsible for selecting appropriate Targets and maintaining backups, recovery measures and reasonable safeguards for sensitive data.
Bright is not responsible for alerts, blocking, suspensions or other interference by third-party providers resulting from Customer-authorized testing, except to the extent arising from Bright’s breach of the Agreement or this AI Addendum.
5. AI Limitations and Customer Responsibilities
5.1 AI Limitations
AI Features use probabilistic technologies and may produce inaccurate, incomplete, unexpected or erroneous results, including hallucinations, false positives, false negatives, incorrect recommendations, findings or actions.
Bright does not warrant that AI Features or AI Output will be accurate, complete, error-free, identify all vulnerabilities, achieve any particular result or be suitable as the sole basis for a material decision.
AI PT is a point-in-time assessment. Findings may not be reproducible or fully explainable and do not constitute a certification that any tested environment is secure.
5.2 Customer Review
Customer is responsible for reviewing and validating AI Output and proposed AI Actions as appropriate before materially relying on them for security, operational or business decisions.
Customer is responsible for assessing and remediating vulnerabilities identified through AI PT at its discretion and expense.
5.3 Acceptable Use
Customer will not use AI Features in violation of applicable law, third-party rights, the Agreement, the Documentation or safeguards implemented by Bright.
6. Usage, Changes and Suspension
6.1 Other AI Feature Usage
AI Features other than the AI Assistant may be subject to usage limits, credits or additional fees as specified in the applicable Order, subscription plan, Documentation or Platform.
6.2 Changes to AI Features
Bright may modify AI Features, including AI Providers, models, BYOK options, tools, safeguards and capabilities, subject to the Agreement. Bright does not guarantee the continued availability of any particular AI Provider or model.
6.3 Suspension
Bright may restrict or suspend an AI Feature where reasonably necessary to address security, legal, abuse, provider or operational risks.
7. Agreement Terms
This AI Addendum forms part of the Agreement when incorporated into an Order or proposal accepted by Customer, or accepted electronically by an authorized representative of Customer through the Platform, in each case subject to the Agreement’s applicable acceptance requirements.
Where the Agreement expressly addresses the same AI-related matter, those terms prevail over conflicting general provisions of this AI Addendum. Section 4 specifically governs AI PT and applies in addition to the Agreement, unless the Parties expressly agree otherwise.
All other terms of the Agreement, including its limitations of liability and applicable data protection obligations, remain in effect.
LAST UPDATED: October 15, 2026
