--- title: "Security — Arbol" description: "How to report a security issue to Arbol, the rules for good-faith research and how to recognize the sites and messages that really come from Arbol." url: https://www.getarbol.com/en/security/ lang: en alternates: es: https://www.getarbol.com/security/ --- # Security Arbol Artificial Intelligence, Inc. · Updated September 28, 2026 The short version - Found a flaw? Write to support\@getarbol.com. - We confirm every report and follow it through to closure. - Our sites always end in getarbol.com. - We never ask for your password by WhatsApp, phone or email. Looking for how we protect your patients' data? It's in the [Trust Center](https://www.getarbol.com/legal/trust-global/). ## How to report a vulnerability Write to [support@getarbol.com](mailto:support@getarbol.com?subject=Security) with “Security” in the subject. Tell us: - What you found and where: the address or the screen. - The steps to reproduce it. - What you think someone could do with it. - How to reach you. We confirm every report, triage it and follow it through to closure. ## Rules for good-faith research - Use only your own accounts or test accounts. Don't access other people's information. - If you come across patient or institution data, stop, don't copy or keep it, and tell us right away. - Don't change or delete information and don't disrupt the service: no load testing and no mass sending. - Don't try to trick our team or our customers into giving you access. - Give us reasonable time to fix it before you publish what you found. If you follow these rules, we consider your research authorized and in good faith, and we won't take legal action against you for it. ## What it covers getarbol.com and its subdomains: this site, the applications, the API and the documentation. It doesn't cover third-party services we use (report those to whoever makes them), automated scan reports without proof of what they allow, or general recommendations without a concrete risk. ## How to know it's really Arbol Our sites and applications live only on getarbol.com and its subdomains: - **www\.getarbol.com**: this site. - **app.getarbol.com**, **ambar.getarbol.com** and **calendar.getarbol.com**: the applications. You sign in from [getarbol.com/en/sign-in](https://www.getarbol.com/en/sign-in/). - **docs.getarbol.com** and **api.getarbol.com**: the documentation and the API. Our emails come from an address ending in @getarbol.com or @email.getarbol.com. Arbol never asks for your password or a verification code by WhatsApp, phone or email. If a message or a site claims to be Arbol and doesn't match this, forward it to [support@getarbol.com](mailto:support@getarbol.com?subject=Impersonation) with “Impersonation” in the subject. ## The security.txt file For security teams and tools, the same details are published in the standard format (RFC 9116) at [getarbol.com/.well-known/security.txt](https://www.getarbol.com/.well-known/security.txt). ## Contact **Arbol Artificial Intelligence, Inc.**\ 131 Continental Dr, Suite 305, Newark, DE 19713, United States\ Email: Security questions? [Trust Center](https://www.getarbol.com/legal/trust-global/) [Privacy Policy](https://www.getarbol.com/en/privacy/) --- **Arbol AI** — AI agents for clinics and healthcare providers: they answer and reach patients by phone, WhatsApp, SMS, email and web chat, book their appointments 24/7 and keep a record of every conversation. - Original page: - Book a demo: · Pricing: - Agent index: · Support: