These AI Monitoring and Guard Terms supplement the Terms of Service and govern FlashTower Monitor and FlashTower Guard. Capitalized terms have the meanings given in the Terms of Service. If these terms conflict with the Terms of Service on these topics, these terms control.
1. Summary
Limits and responsibility
FlashTower is designed to help identify, monitor, detect, assess, and report certain AI-related risks and security events. No security system can identify, detect, prevent, or report every threat, vulnerability, unauthorized action, malicious actor, AI behavior, configuration issue, or security incident. FlashTower acts on Customer's systems only when Customer's own authorized people approve an action or explicitly authorize an Automation Policy. Customer remains responsible for the permissions it grants and the decisions it makes.
2. FlashTower Monitor
- What it observes. Monitor compares the recorded state of Customer's AI systems over time — the AI systems, permissions, data sources, and assessment answers Customer records in FlashTower and, where Customer connects them, read-only connectors to third-party services. A connector observes only what the scopes Customer granted allow, and Customer can disconnect it at any time.
- How it classifies. Changes are classified and assigned severities only by FlashTower's deterministic rules. AI narrative never determines scores or severities.
- What it cannot see. Monitor does not see systems, accounts, or activity that are not recorded or connected, and its results are only as accurate as its sources.
- Alerts. Alerts are informational and may be delayed, deduplicated, suppressed according to Customer's settings, or not delivered for reasons outside FlashTower's control. Customer should review alerts in the application and not rely solely on email.
- Monitoring of people. Monitor is designed to observe AI systems and their permissions, not the content of employees' communications. Customer is responsible for any notices or consents that applicable law requires for its monitoring.
3. Guard levels
| Level | What FlashTower may do | Who authorizes |
|---|---|---|
| A — Monitor only (default) | Observe, alert, and recommend. No changes to Customer's systems. | Not applicable |
| B — Approval required | Execute a recommended action through a connected integration after approval. | An Owner, Admin, or Security Admin of Customer's organization, for each action |
| C — Pre-authorized automation | Execute an action automatically, only when an Automation Policy's conditions are met and within its limits and cooldowns. | An Owner or Admin of Customer's organization, who creates and enables the policy |
| D — Autonomous containment | Not offered. | Not applicable |
Approvals (Level B) and automation (Level C) are separate, explicit opt-ins. Customer may return to Level A at any time.
4. Safeguards
- Dry-run by default. In dry-run mode FlashTower shows what an action would do and records it, but changes nothing.
- High-impact actions (for example, revoking a credential or suspending an agent) require approval from a multi-factor-authenticated session and typed confirmation. Customer may require two separate approvers.
- Limits. Per-action and per-integration switches, rate limits, and automation cooldowns bound what can happen even when an action is authorized.
- No FlashTower staff approvals. FlashTower personnel never approve, deny, or pre-authorize actions on Customer's behalf. This is enforced by the database, not only by the application.
- Audit trail. Recommendations, approvals, denials, policy changes, and outcomes are recorded with the responsible user and time.
5. Emergency controls
Your organization's owners and admins can switch off Guard automation at any time (kill switch). FlashTower may pause Guard execution platform-wide for safety; a pause can only stop actions from executing, never start them.
If a platform-wide pause blocks an action Customer approved, the approval remains recorded and Customer can complete the change manually in the provider's console.
6. Current availability
Guard actions execute in Customer's systems only for an integration where Customer has separately granted Guard access and turned Guard on for that integration. Each such grant requests least-privilege scopes, and each action supports a side-effect-free preview (dry run, the default). For any other integration, and for actions no integration supports, approved actions are recorded and Customer's team completes them manually and marks them done. Customer can remove Guard access at any time without disconnecting the read-only integration where the provider allows it.
7. Customer authorization and responsibility
- Customer represents that it is authorized to connect every system and account it connects, to grant FlashTower each permission it grants, and to approve or pre-authorize actions on those systems.
- Customer decides whether each action runs. Approved and automated actions can interrupt business processes, revoke access people rely on, or be irreversible (for example, rotating a credential). Customer should review previews, keep dry-run mode on until confident, and set limits suited to its environment.
- Customer remains responsible for its incident response, for completing actions FlashTower cannot perform, and for decisions based on FlashTower's recommendations.
- Recommendations are generated by deterministic rules from the information available to FlashTower and may not suit Customer's circumstances.
FlashTower Guard acts only on actions your organization approves or on policies your authorized administrators explicitly pre-authorize. Your organization remains responsible for the permissions it grants FlashTower and for the decisions it makes. Automated responses can interrupt business processes; use dry-run mode, limits, and approvals appropriate to your environment. No security system detects or stops every threat.
8. No guarantee
No security system can identify or prevent every threat. FlashTower does not guarantee the prevention of every attack, the detection of every threat, vulnerability, or incident, perfect security, perfect or predictable behavior of any AI system, uninterrupted or error-free operation of the Service, or any regulatory, certification, audit, or compliance outcome.
- FlashTower findings and alerts are informational.
- FlashTower does not guarantee detection of every threat.
- FlashTower does not guarantee prevention of incidents.
- FlashTower does not certify compliance.
- FlashTower does not provide legal advice.
- FlashTower Guard does not guarantee that any threat will be contained or that any action will succeed.
Contact
FlashTower is operated by Boostlete LLC, 1620 N Carpenter Rd, Suite D46, Modesto, CA 95351. Privacy and legal notices: privacy@flashtower.com. Security: security@flashtower.com. Support: support@flashtower.com. Billing: billing@flashtower.com. General inquiries: hello@flashtower.com.